kubernetes/kops · error

IAM instance profile not yet created/propagated (original er

Error message

IAM instance profile not yet created/propagated (original error: %v)

What it means

When creating an Elastigroup, Spotinst may reject the IAM instance profile because AWS propagation has not completed. kOps retries with a readyLoop wait; if attempts exceed maxAttempts it surfaces this error including the original Spotinst error message. It is a timing/propagation failure of the AWS IAM profile referenced by the group.

Source

Thrown at upup/pkg/fi/cloudup/spotinsttasks/elastigroup.go:782

		time.Sleep(10 * time.Second)

		// Wrap the raw object as an Elastigroup.
		eg, err := spotinst.NewElastigroup(cloud.ProviderID(), group)
		if err != nil {
			return err
		}

		// Create the Elastigroup.
		_, err = cloud.Spotinst().Elastigroup().Create(context.Background(), eg)
		if err == nil {
			break
		}

		if errs, ok := err.(client.Errors); ok {
			for _, err := range errs {
				if strings.Contains(err.Message, "Invalid IAM Instance Profile name") {
					if attempt > maxAttempts {
						return fmt.Errorf("IAM instance profile not yet created/propagated (original error: %v)", err)
					}

					klog.V(4).Infof("Got an error indicating that the IAM instance profile %q is not ready %q", fi.ValueOf(e.IAMInstanceProfile.Name), err)
					klog.Infof("Waiting for IAM instance profile %q to be ready", fi.ValueOf(e.IAMInstanceProfile.Name))
					goto readyLoop
				}
			}

			return fmt.Errorf("spotinst: failed to create elastigroup: %v", err)
		}
	}

	return nil
}

func (_ *Elastigroup) update(cloud awsup.AWSCloud, a, e, changes *Elastigroup) error {
	klog.V(2).Infof("Updating Elastigroup %q", *e.Name)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the IAM instance profile name/ARN in the cluster spec actually exists in AWS: aws iam get-instance-profile --instance-profile-name <name>.
2. If it exists and is new, simply re-run `kops update cluster` after a minute — propagation usually completes.
3. If it does not exist, recreate the IAM resources (kops create secret/apply IAM templates) or fix the name in the spec.
4. Check the original error in the message for other IAM problems (permissions, wrong account).

// verify the instance profile exists before creating the group
_, err := awsClient.IAM().GetInstanceProfile(&iam.GetInstanceProfileInput{
    InstanceProfileName: aws.String(profileName),
})
if err != nil {
    return fmt.Errorf("instance profile %q does not exist yet", profileName)
}

if errs, ok := err.(client.Errors); ok {
    for _, e := range errs {
        if strings.Contains(e.Message, "Invalid IAM Instance Profile name") && attempt <= maxAttempts {
            time.Sleep(30 * time.Second) // wait for IAM propagation, then retry
            goto readyLoop
        }
    }
}
return fmt.Errorf("IAM instance profile not yet created/propagated (original error: %v)", err)

When it happens

Trigger: create() calls the Spotinst Create API, gets client.Errors containing "Invalid IAM Instance Profile name", and attempt > maxAttempts after repeatedly waiting for propagation.

Common situations: A brand-new cluster where the IAM instance profile was created seconds before the Elastigroup (AWS IAM eventual consistency); a typo'd or nonexistent instance profile name in the spec; IAM profile deleted out-of-band; very slow AWS propagation in a region.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w
• arn %q has unrecognized type

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6f8314925b9cc5b0. Report an issue: GitHub.