What causes "error rendering RolePolicyAttachment: %v" in kubernetes/kops?

Check the wrapped error; if it is I/O related, verify the --out directory exists and is writable.

error rendering RolePolicyAttachment: %v

Error message

error rendering RolePolicyAttachment: %v

What it means

RenderTerraform renders the aws_iam_role_policy_attachment resource via t.RenderResource; this wraps any failure of that rendering step (template/target writing errors in the terraform target). It is not an AWS error — terraform output generation failed for the attachment resource.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:329

}

func (_ *IAMRolePolicy) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRolePolicy) error {
	if e.ExternalPolicies != nil && len(*e.ExternalPolicies) > 0 {
		for _, policy := range *e.ExternalPolicies {
			// create a hash of the arn
			h := fnv.New32a()
			h.Write([]byte(policy))

			name := fmt.Sprintf("%s-%d", *e.Name, h.Sum32())

			tf := &terraformIAMRolePolicy{
				Role:      e.Role.TerraformLink(),
				PolicyArn: s(policy),
			}

			err := t.RenderResource("aws_iam_role_policy_attachment", name, tf)
			if err != nil {
				return fmt.Errorf("error rendering RolePolicyAttachment: %v", err)
			}
		}
	}

	policyString, err := e.policyDocumentString()
	if err != nil {
		return fmt.Errorf("error rendering PolicyDocument: %v", err)
	}

	if policyString == "" {
		// A deletion; we simply don't render; terraform will observe the removal
		return nil
	}

	policy, err := t.AddFileResource("aws_iam_role_policy", *e.Name, "policy", e.PolicyDocument, false)
	if err != nil {
		return fmt.Errorf("error rendering PolicyDocument: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Check the wrapped error; if it is I/O related, verify the --out directory exists and is writable.
Re-run kops update --target=terraform after freeing disk space or fixing permissions.
Report a bug to kops if the render fails consistently with a valid target.

Example fix

// before
kops update cluster --target=terraform --out=/read-only/path
// after
kops update cluster --target=terraform --out=/writable/outdir

Defensive patterns

Strategy: try-catch

Validate before calling

if err := os.MkdirAll(outDir, 0o755); err != nil { return err }
if err := writable(outDir); err != nil { return fmt.Errorf("out dir not writable: %w", err) }

Try / catch

if err := runKopsUpdate(); err != nil {
  if strings.Contains(err.Error(), "error rendering RolePolicyAttachment") {
    klog.Errorf("terraform render failed: %v", err)
  }
  return err
}

Prevention

Ensure --out points to a writable path with free disk space.
Run terraform-target generation in CI before any apply to catch render bugs early.
Pin a known-good kops version; render failures at this point are usually internal bugs or FS issues.

When it happens

Trigger: t.RenderResource("aws_iam_role_policy_attachment", ...) returns an error, typically from the underlying render/write machinery in the terraform target (I/O error writing tf files, or an internal render failure).

Common situations: Outbdir/target directory not writable or full disk; bug or type mismatch in the rendered terraform struct; running kops update --out to an invalid path.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/117f625d9ee4bba5. Report an issue: GitHub.