kubernetes/kops · error

error reading actual policy document: %v

Error message

error reading actual policy document: %v

What it means

During update comparison, RenderAWS re-renders the existing (actual) task's RolePolicyDocument with fi.ResourceAsString to diff it against the desired policy. If rendering the actual resource fails (template execution or resource conversion), it returns 'error reading actual policy document: %v'. A nil actual resource is handled — only a non-nil unrenderable resource reaches this error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:270

		response, err := t.Cloud.IAM().CreateRole(ctx, request)
		if err != nil {
			klog.V(2).Infof("IAMRole policy: %s", policy)
			return fmt.Errorf("error creating IAMRole: %v", err)
		}

		e.ID = response.Role.RoleId
	} else {
		if changes.RolePolicyDocument != nil {
			klog.V(2).Infof("Updating IAMRole AssumeRolePolicy %q", *e.Name)

			var err error

			actualPolicy := ""
			if a.RolePolicyDocument != nil {
				actualPolicy, err = fi.ResourceAsString(a.RolePolicyDocument)
				if err != nil {
					return fmt.Errorf("error reading actual policy document: %v", err)
				}
			}

			if actualPolicy == policy {
				klog.Warning("Policies were actually the same")
			} else {
				d := diff.FormatDiff(actualPolicy, policy)
				klog.V(2).Infof("diff: %s", d)
			}

			request := &iam.UpdateAssumeRolePolicyInput{}
			request.PolicyDocument = aws.String(policy)
			request.RoleName = e.Name

			_, err = t.Cloud.IAM().UpdateAssumeRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error updating IAMRole: %v", err)
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the inner error to find the failing template key or syntax issue
2. Run kops replace -f with a corrected policy document or upgrade kOps so both sides render with the same context
3. If the state store task snapshot is stale/corrupt, use kops toolbox dump to inspect and re-apply a fixed spec
4. Avoid custom TemplateResources for policy docs; use literal string resources so rendering cannot fail

Example fix

// before: custom template resource in actual state
RolePolicyDocument: fi.NewTemplateResource("policies", "{{ .OldField }}")

// after: literal document, render cannot fail
RolePolicyDocument: fi.NewStringResource(renderedJSON)

if a.RolePolicyDocument != nil {
    actualPolicy, err := fi.ResourceAsString(a.RolePolicyDocument)
    if err != nil {
        // fall back: refetch from AWS instead of failing the diff
        return fetchPolicyFromAWS(roleName)
    }
    _ = actualPolicy
}

func canDiff(actual, desired fi.Resource) bool {
    _, e1 := fi.ResourceAsString(actual)
    _, e2 := fi.ResourceAsString(desired)
    return e1 == nil && e2 == nil
}

When it happens

Trigger: The actual (a.RolePolicyDocument) task was populated from state as a TemplateResource whose template now fails to execute — typically after a kOps upgrade changed template context variables, or a custom template resource with bad syntax was applied previously.

Common situations: Applying a cluster spec built by a different kOps version whose stored template references removed fields; hand-crafted fi.TemplateResource with typos; stale state store snapshot of the task.

Related errors

• error rendering RolePolicyDocument: %v
• error detaching IAM role policy %q: %v
• error deleting IAM role: %v
• error creating IAMRole: %v
• error updating IAMRole: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bb5a3f64a1ca3c13. Report an issue: GitHub.