kubernetes/kops · error

role name length must be equal to 64 or less: %q

Error message

role name length must be equal to 64 or less: %q

What it means

IAM role names are limited to 64 characters. ShouldCreate() validates the desired name before creation and returns this error (with create=false) if it exceeds the limit, aborting the operation rather than hitting a cryptic AWS EntityTooLarge-style failure.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrole.go:137

	actual.Tags = mapIAMTagsToMap(r.Tags)

	klog.V(2).Infof("found matching IAMRole %q", aws.ToString(actual.ID))
	e.ID = actual.ID

	// Avoid spurious changes
	actual.ExportWithID = e.ExportWithID
	actual.Lifecycle = e.Lifecycle

	return actual, nil
}

func (e *IAMRole) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *IAMRole) ShouldCreate(a, e, changes *IAMRole) (bool, error) {
	if len(*e.Name) > 64 {
		return false, fmt.Errorf("role name length must be equal to 64 or less: %q", *e.Name)
	}
	return true, nil
}

func (s *IAMRole) CheckChanges(a, e, changes *IAMRole) error {
	if a != nil {
		if e.Name == nil {
			return fi.RequiredField("Name")
		}
	} else {
		if changes.Name == nil {
			return fi.CannotChangeField("Name")
		}
	}
	return nil
}

func (_ *IAMRole) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *IAMRole) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Shorten the cluster name (and thus derived role names) to keep role names <= 64 chars
2. Reduce any prefix in the kops/IAM naming config so the final name fits
3. Create the cluster with a shorter name and migrate workloads if renaming in place is not possible
4. Check for duplicated suffixes/prefixes in the spec that inflate the name

Example fix

// before: cluster name too long
kops create cluster masters.very-long-production-cluster-name.us-east-1.internal
// after
kops create cluster prod.us-east-1.internal

// validate the derived role name length before creation
name := "kops-controllers." + clusterName
if len(name) > 64 { return fmt.Errorf("role name %q exceeds IAM 64-char limit; shorten cluster name", name) }

When it happens

Trigger: len(*e.Name) > 64: the computed cluster/role name (e.g. masters.<very-long-cluster-name>) exceeds 64 characters at creation time.

Common situations: Very long cluster names or DNS domains producing role names like kops-controllers.<long.domain>; company naming conventions prepending long prefixes; older clusters renamed with longer suffixes.

Related errors

• error parsing expected RolePolicyDocument for IAMRole %q: %v
• IP version is incorrect
• ErrAlreadyExists
• provider ID cannot be empty
• provider ID number cannot be empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ea06ea421813ddb8. Report an issue: GitHub.