kubernetes/kops · error

getting role from profile %s: %v

Error message

getting role from profile %s: %v

What it means

KopsControllerConfig builds the kops-controller static config. When an instance group specifies a custom IAM instance profile (ig.Spec.IAM.Profile), kOps must resolve the actual IAM role attached to that profile via awsup.GetRolesInInstanceProfile. This error wraps any AWS API failure (or empty/missing profile) encountered during that lookup.

Source

Thrown at upup/pkg/fi/cloudup/template_functions.go:875

		}

		switch cluster.GetCloudProvider() {
		case kops.CloudProviderAWS:
			nodesRoles := sets.String{}
			for _, ig := range tf.AllInstanceGroups {
				if ig.Spec.Role.HasNode() || ig.Spec.Role.HasAPIServer() {
					profile, err := tf.LinkToIAMInstanceProfile(ig)
					if err != nil {
						return "", fmt.Errorf("getting profile for ig %s: %v", ig.Name, err)
					}
					// The IAM Instance Profile has not been created at this point if it is not specified.
					// Because the IAM Instance Profile and the IAM Role are created in IAMModelBuilder tasks.
					// Therefore, the IAM Role associated with IAM Instance Profile is acquired only when it is not specified.
					if ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {
						c := tf.cloud.(awsup.AWSCloud)
						roles, err := awsup.GetRolesInInstanceProfile(c, *profile.Name)
						if err != nil {
							return "", fmt.Errorf("getting role from profile %s: %v", *profile.Name, err)
						}
						nodesRoles.Insert(roles...)
					} else {
						// When the IAM Instance Profile is not specified, IAM Instance Profile is created by kOps.
						// In this case, the IAM Instance Profile name and IAM Role name are same.
						// So there is no problem even if IAM Instance Profile name is inserted as role name in nodesRoles.
						nodesRoles.Insert(*profile.Name)
					}
				}
			}
			config.Server.Provider.AWS = &awsbootstrap.AWSVerifierOptions{
				NodesRoles:          nodesRoles.List(),
				Region:              tf.Region,
				UseIPBasedNodeNames: fi.ValueOf(cluster.Spec.CloudProvider.AWS.UseIPBasedNodeNames),
			}

		case kops.CloudProviderGCE:
			c := tf.cloud.(gce.GCECloud)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the IAM instance profile name in ig.Spec.IAM.Profile exists in the target AWS account/region (aws iam get-instance-profile --instance-profile-name <name>).
2. Ensure the credentials kOps uses have iam:GetInstanceProfile permission.
3. Re-run after transient AWS API errors (throttling) or reduce API call rate.
4. If the profile is wrong, remove spec.iam.profile so kOps creates its own profile/role.

Example fix

// before (cluster.yaml)
iam:
  profile: profle-name-typo
// after
iam:
  profile: nodes.cluster.example.com

// Go: validate the profile before rendering the config
prof := *ig.Spec.IAM.Profile
out, err := awsIamClient.GetInstanceProfile(&iam.GetInstanceProfileInput{InstanceProfileName: aws.String(prof)})
if err != nil || out.InstanceProfile == nil {
    return fmt.Errorf("instance profile %q not found or inaccessible: %w", prof, err)
}

When it happens

Trigger: AWS cluster where an instance group sets spec.iam.profile but the profile does not exist in the account/region, the credentials lack iam:GetInstanceProfile/ListInstanceProfiles permission, throttling occurs, or the AWSCloud client call otherwise fails.

Common situations: Typo in the profile name in the cluster spec; profile created in a different account; IAM policy missing for the kOps controller; profile deleted after spec was written; cross-account setups without proper trust/permissions.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/041bcd70664c580b. Report an issue: GitHub.