kubernetes/kops · error

getting profile for ig %s: %v

Error message

getting profile for ig %s: %v

What it means

Thrown in KopsControllerConfig (AWS branch) when LinkToIAMInstanceProfile fails for an instance group with a node or API-server role. The failure is in resolving/validating the IAM instance profile for that IG — typically a missing IAM profile task, an invalid profile name, or an unset role for the IG.

Source

Thrown at upup/pkg/fi/cloudup/template_functions.go:866

			ServerCertificatePath: path.Join(pkiDir, "kops-controller.crt"),
			ServerKeyPath:         path.Join(pkiDir, "kops-controller.key"),
			CABasePath:            pkiDir,
			SigningCAs:            signingCAs,
			CertNames:             certNames,
		}

		if featureflag.Metal.Enabled() {
			config.Server.PKI = &pkibootstrap.Options{}
		}

		switch cluster.GetCloudProvider() {
		case kops.CloudProviderAWS:
			nodesRoles := sets.String{}
			for _, ig := range tf.AllInstanceGroups {
				if ig.Spec.Role.HasNode() || ig.Spec.Role.HasAPIServer() {
					profile, err := tf.LinkToIAMInstanceProfile(ig)
					if err != nil {
						return "", fmt.Errorf("getting profile for ig %s: %v", ig.Name, err)
					}
					// The IAM Instance Profile has not been created at this point if it is not specified.
					// Because the IAM Instance Profile and the IAM Role are created in IAMModelBuilder tasks.
					// Therefore, the IAM Role associated with IAM Instance Profile is acquired only when it is not specified.
					if ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {
						c := tf.cloud.(awsup.AWSCloud)
						roles, err := awsup.GetRolesInInstanceProfile(c, *profile.Name)
						if err != nil {
							return "", fmt.Errorf("getting role from profile %s: %v", *profile.Name, err)
						}
						nodesRoles.Insert(roles...)
					} else {
						// When the IAM Instance Profile is not specified, IAM Instance Profile is created by kOps.
						// In this case, the IAM Instance Profile name and IAM Role name are same.
						// So there is no problem even if IAM Instance Profile name is inserted as role name in nodesRoles.
						nodesRoles.Insert(*profile.Name)
					}
				}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check that the IG's spec.iam.profile is set to a valid IAM profile or the well-known names kOps manages
2. Ensure the IAMInstanceProfile tasks were generated before kops-controller config rendering (check for missing dependencies)
3. On AWS, verify the referenced instance profile exists in the account and the role is attached

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/template_functions.go:866 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/990965444bf9c4eb. Report an issue: GitHub.