kubernetes/kops · error

error rendering RolePolicyDocument: %v

Error message

error rendering RolePolicyDocument: %v

What it means

RenderAWS renders the desired role's trust/assume-role policy document via fi.ResourceAsString before comparing or sending it to AWS. If the resource is not plain bytes — e.g. it is a fi.TemplateResource whose Go template execution fails — the error is wrapped as 'error rendering RolePolicyDocument: %v'.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:238

			}
			_, err := t.Cloud.IAM().DetachRolePolicy(ctx, request)
			if err != nil {
				return fmt.Errorf("error detaching IAM role policy %q: %v", *policy.PolicyArn, err)
			}
		}

		request := &iam.DeleteRoleInput{
			RoleName: a.Name,
		}
		if _, err := t.Cloud.IAM().DeleteRole(ctx, request); err != nil {
			return fmt.Errorf("error deleting IAM role: %v", err)
		}
		return nil
	}

	policy, err := fi.ResourceAsString(e.RolePolicyDocument)
	if err != nil {
		return fmt.Errorf("error rendering RolePolicyDocument: %v", err)
	}

	if a == nil {
		klog.V(2).Infof("Creating IAMRole with Name:%q", *e.Name)

		request := &iam.CreateRoleInput{}
		request.AssumeRolePolicyDocument = aws.String(policy)
		request.RoleName = e.Name
		request.Tags = mapToIAMTags(e.Tags)

		if e.PermissionsBoundary != nil {
			request.PermissionsBoundary = e.PermissionsBoundary
		}

		response, err := t.Cloud.IAM().CreateRole(ctx, request)
		if err != nil {
			klog.V(2).Infof("IAMRole policy: %s", policy)
			return fmt.Errorf("error creating IAMRole: %v", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error: it names the missing template key or parse failure
2. Fix the template variable names to match the RenderAWS context fields
3. Ensure the template file is embedded/packaged (verify the fi.TemplateResource path is correct)
4. If using a custom build, verify the asset was included in the build step

Example fix

// before: typo in template variable
"{{ .AssumeRolePolicyPrincipal }}"

// after: use the defined context field
"{{ .Principal }}"

// Render the document yourself before handing it to the task
policyJSON, err := fi.ResourceAsString(rolePolicyDocument)
if err != nil { return fmt.Errorf("invalid RolePolicyDocument: %w", err) }
var doc map[string]interface{}
if err := json.Unmarshal([]byte(policyJSON), &doc); err != nil {
    return fmt.Errorf("RolePolicyDocument is not valid JSON: %w", err)
}

func isRenderableResource(r fi.Resource) bool {
    _, err := fi.ResourceAsString(r)
    return err == nil
}

When it happens

Trigger: The RolePolicyDocument is a fi.TemplateResource and its template references undefined variables or functions, the template file is missing from the built binary, or the embedded template execution step fails.

Common situations: Custom changes that replace the policy document with a template using a typo'd variable; kOps version upgrades renaming template context fields; vendored template asset not embedded in the build.

Related errors

• error reading actual policy document: %v
• error detaching IAM role policy %q: %v
• error deleting IAM role: %v
• error creating IAMRole: %v
• error updating IAMRole: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d67d07bb0fe72bd9. Report an issue: GitHub.