kubernetes/kops · error

error rendering PolicyDocument: %v

Error message

error rendering PolicyDocument: %v

What it means

IAMRolePolicy.ShouldCreate renders the desired PolicyDocument via policyDocumentString(), which reads the fi.Resource and enforces the 10240-byte IAM inline policy limit. Any read or size-check failure is wrapped as 'error rendering PolicyDocument'. This decides whether the task needs creating.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:161

}

func (e *IAMRolePolicy) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *IAMRolePolicy) CheckChanges(a, e, changes *IAMRolePolicy) error {
	if a != nil {
		if e.Name == nil {
			return fi.RequiredField("Name")
		}
	}
	return nil
}

func (_ *IAMRolePolicy) ShouldCreate(a, e, changes *IAMRolePolicy) (bool, error) {
	ePolicy, err := e.policyDocumentString()
	if err != nil {
		return false, fmt.Errorf("error rendering PolicyDocument: %v", err)
	}

	if a == nil && ePolicy == "" && e.ExternalPolicies == nil {
		return false, nil
	}

	return true, nil
}

func (_ *IAMRolePolicy) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMRolePolicy) error {
	ctx := context.TODO()
	policy, err := e.policyDocumentString()
	if err != nil {
		return fmt.Errorf("error rendering PolicyDocument: %v", err)
	}

	// Handles the full lifecycle of Policy Overrides
	if e.Managed {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error — if it is the size error, shrink the policy under 10240 bytes or switch to managed policies via ExternalPolicies
2. Ensure the PolicyDocument resource is present and readable in the cluster spec
3. Validate policy JSON size locally before running kops update
4. Re-run `kops update cluster` after fixing the resource

Example fix

// before: huge inline policy
// after: use managed policies instead
iamRolePolicy := &awstasks.IAMRolePolicy{
  Role: role,
  ExternalPolicies: &[]string{"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"},
  Managed: true,
}

// check policy size before kops update
policy, _ := os.ReadFile("policy.json")
if len(policy) > 10240 {
  log.Fatal("policy exceeds IAM 10240-byte inline limit; use a managed policy")
}
var v any
if err := json.Unmarshal(policy, &v); err != nil { log.Fatal(err) }

if err := kopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error rendering PolicyDocument") {
    // shrink policy or switch to ExternalPolicies, then retry
  }
}

When it happens

Trigger: e.PolicyDocument's Resource cannot be read (embedded file missing, ReadBytes error), or the rendered policy exceeds 10240 bytes during the ShouldCreate lifecycle hook.

Common situations: Overly large IAM policies generated from many permissions; assets/files referenced by the policy missing from the model; broken custom fi.Resource implementations.

Related errors

• error parsing PolicyDocument for IAMRolePolicy %q: %v
• error parsing cloudformation policy document from JSON: %v
• error converting cloudformation policy document to JSON: %v
• error reading actual policy document: %v
• IP version is incorrect

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7b58d56f9b4482d8. Report an issue: GitHub.