kubernetes/kops · error

failed to add service account for %q: %w

Error message

failed to add service account for %q: %w

What it means

RemapAddonManifest wraps failures from addServiceAccountRole — which rewrites pod specs to attach IAM-bound service accounts (IRSA) — with this error naming the addon. The underlying cause is a failure to reparse spec.template.spec, call iam.AddServiceAccountRole, or write the pod spec back.

Source

Thrown at pkg/model/components/addonmanifests/remap.go:61

		objects, err := kubemanifest.LoadObjectsFrom(manifest)
		if err != nil {
			return nil, err
		}

		if name == "dns-controller.addons.k8s.io" {
			if err := dnscontroller.Remap(context, addon, objects); err != nil {
				return nil, err
			}
		}

		err = addLabels(addon, objects)
		if err != nil {
			return nil, fmt.Errorf("failed to annotate %q: %w", name, err)
		}

		err = addServiceAccountRole(context, objects, serviceAccounts)
		if err != nil {
			return nil, fmt.Errorf("failed to add service account for %q: %w", name, err)
		}

		b, err := objects.ToYAML()
		if err != nil {
			return nil, err
		}
		manifest = b
	}

	{
		remapped, err := assetBuilder.RemapManifest(manifest)
		if err != nil {
			return nil, fmt.Errorf("error remapping manifest %s: %v", name, err)
		}
		manifest = remapped
	}

	return manifest, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped inner error for the exact failing object and step
2. Restore the stock addon manifest matching the installed kops version
3. Ensure each workload's spec.template.spec is a valid, standard PodSpec
4. Check podSpec.ServiceAccountName matches a service account kops knows about for this addon

Example fix

// before: custom pod template with unsupported field breaks round-trip
spec:
  template:
    spec:
      customNonstandardField: x
// after: standard PodSpec only
spec:
  template:
    spec:
      serviceAccountName: dns-controller

// Confirm every workload references a known service account:
for _, obj := range objects {
    if !hasPodSpecTemplate(obj) { continue }
    podSpec := &corev1.PodSpec{}
    if err := obj.Reparse(podSpec, "spec", "template", "spec"); err != nil {
        return fmt.Errorf("pre-check reparse failed: %v", err)
    }
    if _, ok := serviceAccounts[types.NamespacedName{Name: podSpec.ServiceAccountName, Namespace: obj.GetNamespace()}]; !ok {
        log.Printf("note: SA %q not managed by kops; it will be skipped", podSpec.ServiceAccountName)
    }
}

if err := addServiceAccountRole(ctx, objects, sas); err != nil {
    return fmt.Errorf("failed to add service account for %q: %w", name, err)
}

When it happens

Trigger: RemapAddonManifest with UseServiceAccountExternalPermissions enabled, where any object with an apps/v1 Deployment/DaemonSet template fails Reparse, AddServiceAccountRole, or object.Set — e.g. non-standard pod template structure that cannot round-trip as corev1.PodSpec.

Common situations: Custom/patched addon manifests with unusual pod template fields (e.g. unknown fields or unsupported types that break strict reparse); an addon referencing a service account not present in the serviceAccounts map; kops version mismatch with manifest schema.

Related errors

• error building service account role tasks: %w
• expected exactly one container in dns-controller Deployment,
• failed to annotate %q: %w
• error remapping manifest %s: %v
• failed to parse spec.template.spec from Deployment: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/392971bd743edd59. Report an issue: GitHub.