kubernetes/kops · error

error rendering RolePolicyDocument: %v

Error message

error rendering RolePolicyDocument: %v

What it means

In kOps' AWS task renderer for SQS queues, the task's Policy resource (the queue's IAM policy document) is rendered to a string before creating/updating the queue. If that resource cannot be materialized (e.g. a file-based or delegated resource fails to load), RenderAWS aborts with "error rendering RolePolicyDocument". The underlying cause is always wrapped in the %v suffix.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/sqs.go:213

func (q *SQS) CheckChanges(a, e, changes *SQS) error {
	if a == nil {
		if e.Name == nil {
			return field.Required(field.NewPath("Name"), "")
		}
	}
	if a != nil {
		if changes.URL != nil {
			return fi.CannotChangeField("URL")
		}
	}
	return nil
}

func (q *SQS) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *SQS) error {
	ctx := context.TODO()
	policy, err := fi.ResourceAsString(e.Policy)
	if err != nil {
		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)
	}

	if a == nil {
		request := &sqs.CreateQueueInput{
			Attributes: map[string]string{
				"MessageRetentionPeriod": strconv.Itoa(q.MessageRetentionPeriod),
				"Policy":                 policy,
			},
			QueueName: q.Name,
			Tags:      q.Tags,
		}
		response, err := t.Cloud.SQS().CreateQueue(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating SQS queue: %v", err)
		}

		attributes, err := t.Cloud.SQS().GetQueueAttributes(ctx, &sqs.GetQueueAttributesInput{
			AttributeNames: []sqstypes.QueueAttributeName{sqstypes.QueueAttributeNameQueueArn},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error text after the colon to find the real cause (file not found, empty resource, etc.).
2. Verify the Policy resource path/file exists and is readable from where kOps runs.
3. Ensure the task spec always sets Policy (e.g. fi.NewStringResource(policyJSON)) before render.
4. If generating policy programmatically, validate the JSON builds without error before assigning it to the task.

Example fix

// before
Policy: fi.NewResourceHolder(...) // never resolved
// after
policyJSON, err := buildQueuePolicy(cluster)
if err != nil { return err }
e.Policy = fi.NewStringResource(policyJSON)

if task.Policy == nil { return fmt.Errorf("SQS task %s has no Policy set", fi.ValueOf(task.Name)) }
if _, err := fi.ResourceAsString(task.Policy); err != nil {
    return fmt.Errorf("policy for queue %s cannot be rendered: %w", fi.ValueOf(task.Name), err)
}

When it happens

Trigger: fi.ResourceAsString(e.Policy) returns an error: the Policy resource is nil-backed, the referenced local policy file is missing/unreadable, or a ResourceHolder was never resolved with an actual value before render.

Common situations: Cluster spec references an external policy file that doesn't exist on disk; a custom addon hook supplies an empty policy; a templated policy resource fails during delegation; running kOps from a different working directory so relative policy paths break.

Related errors

• rendering policy as json: %w
• error deleting SQS queue %q: %w
• error listing SQS queues: %v
• error creating EventBridge target: %v
• Subnet ID not set

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/446e5fbbfe935d04. Report an issue: GitHub.