kubernetes/kops · error

IAM instance profile not yet created/propagated (original er

Error message

IAM instance profile not yet created/propagated (original error: %v)

What it means

When creating an Ocean, the Spotinst API can reject the request with 'Invalid IAM Instance Profile name' because the IAM instance profile kops just created has not yet propagated in AWS. The create routine retries with backoff, and after exhausting maxAttempts it gives up with this message wrapping the original client error.

Source

Thrown at upup/pkg/fi/cloudup/spotinsttasks/ocean.go:638

		time.Sleep(10 * time.Second)

		// Wrap the raw object as an Ocean.
		oc, err := spotinst.NewOcean(cloud.ProviderID(), ocean)
		if err != nil {
			return err
		}

		// Create a new Ocean.
		_, err = cloud.Spotinst().Ocean().Create(context.Background(), oc)
		if err == nil {
			break
		}

		if errs, ok := err.(client.Errors); ok {
			for _, err := range errs {
				if strings.Contains(err.Message, "Invalid IAM Instance Profile name") {
					if attempt > maxAttempts {
						return fmt.Errorf("IAM instance profile not yet created/propagated (original error: %v)", err)
					}

					klog.V(4).Infof("Got an error indicating that the IAM instance profile %q is not ready %q", fi.ValueOf(e.IAMInstanceProfile.Name), err)
					klog.Infof("Waiting for IAM instance profile %q to be ready", fi.ValueOf(e.IAMInstanceProfile.Name))
					goto readyLoop
				}
			}

			return fmt.Errorf("spotinst: failed to create ocean: %v", err)
		}
	}

	return nil
}

func (_ *Ocean) update(cloud awsup.AWSCloud, a, e, changes *Ocean) error {
	klog.V(2).Infof("Updating Ocean %q", *e.Name)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Simply re-run kops update cluster / apply after a minute — the instance profile will have propagated
2. Verify the IAM instance profile exists: aws iam get-instance-profile --instance-profile-name <name>
3. Check IAM policies/permissions allow the kops principal to pass the role
4. If persistent, recreate the instance profile and wait for it to be attachable before applying

_, err := iam.GetInstanceProfile(&iam.GetInstanceProfileInput{Name: aws.String(profileName)})
if err != nil {
    return fmt.Errorf("instance profile %q not visible yet; wait before creating ocean", profileName)
}

if errs, ok := err.(client.Errors); ok {
    for _, e := range errs {
        if strings.Contains(e.Message, "Invalid IAM Instance Profile name") {
            // wait and retry; IAM propagation is eventual
            time.Sleep(30 * time.Second)
            continue
        }
    }
    return err
}

When it happens

Trigger: Ocean create is retried maxAttempts times; each attempt the Spotinst API returns a client.Errors entry containing 'Invalid IAM Instance Profile name' because the instance profile is not yet visible.

Common situations: Brand-new instance group whose IAM instance profile was created seconds earlier; eventual consistency in AWS IAM; slow AWS region propagation; control-plane nodes referenced before IAM settles.

Related errors

• error fetching GCE instance: %w
• error getting IAMInstanceProfile: %v
• instance role profile with id %q not found
• error creating IAMInstanceProfile: %v
• error untagging IAMInstanceProfile: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3b01301f954d1647. Report an issue: GitHub.