kubernetes/kops · error

error getting role: %v

Error message

error getting role: %v

What it means

Find() calls IAM GetRole to snapshot the actual state of an IAMRole task. Any error other than NoSuchEntityException (which means the role is absent and treated as nil) is wrapped as 'error getting role'. This means AWS refused or failed to describe the role, not that it is missing.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:75

var _ fi.CompareWithID = (*IAMRole)(nil)

func (e *IAMRole) CompareWithID() *string {
	return e.ID
}

func (e *IAMRole) Find(c *fi.CloudupContext) (*IAMRole, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &iam.GetRoleInput{RoleName: e.Name}

	response, err := cloud.IAM().GetRole(ctx, request)
	if awsup.IsIAMNoSuchEntityException(err) {
		return nil, nil
	}
	if err != nil {
		return nil, fmt.Errorf("error getting role: %v", err)
	}

	r := response.Role
	actual := &IAMRole{}
	actual.ID = r.RoleId
	actual.Name = r.RoleName
	if r.PermissionsBoundary != nil {
		actual.PermissionsBoundary = r.PermissionsBoundary.PermissionsBoundaryArn
	}
	if r.AssumeRolePolicyDocument != nil {
		// The AssumeRolePolicyDocument is URI encoded (?)
		actualPolicy := *r.AssumeRolePolicyDocument
		actualPolicy, err = url.QueryUnescape(actualPolicy)
		if err != nil {
			return nil, fmt.Errorf("error parsing AssumeRolePolicyDocument for IAMRole %s: %v", *e.Name, err)
		}

		// The RolePolicyDocument is reformatted by AWS

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add iam:GetRole (and iam:ListRolePolicies, iam:ListAttachedRolePolicies) to the caller's IAM policy
2. Retry the reconcile if the cause is throttling; consider reducing reconcile concurrency
3. Verify the role name passed to GetRole is the exact IAM role name (no path prefix issues)
4. Check AWS health/status if errors are widespread

// pre-check with a lister instead of assuming GetRole succeeds
roles, err := iamClient.ListRoles(ctx, &iam.ListRolesInput{})
// then match RoleName before calling GetRole

resp, err := cloud.IAM().GetRole(ctx, request)
if err != nil {
    if awsup.IsIAMNoSuchEntityException(err) { return nil, nil }
    var tme *types.ThrottlingException
    if errors.As(err, &tme) { /* retry with backoff */ }
    return nil, fmt.Errorf("error getting role: %w", err)
}

When it happens

Trigger: GetRole returns AccessDenied, throttling (TooManyRequestsException), invalid role name, or a transport/network failure that is not the NoSuchEntity sentinel.

Common situations: kOps controller IAM policy lacks iam:GetRole; large fleets hitting IAM API rate limits; role name with characters invalid for GetRole; transient AWS outage.

Related errors

• error creating AutoScalingGroup: %s
• error listing EventBridge rules: %v
• error listing IAM role policies: %v
• error listing IAM role policies for %v
• error deleting IAM role policy %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e3e3f329d180ddf1. Report an issue: GitHub.