kubernetes/kops · error

role %v does not have ServiceAccount

Error message

role %v does not have ServiceAccount

What it means

Returned by IAMNameForServiceAccountRole when the Subject it is given has an empty ServiceAccount field. kOps derives IAM role/instance-profile names only for Kubernetes service accounts, so a subject without one (e.g. a user or group) cannot be mapped to a role name and the model build aborts.

Source

Thrown at pkg/model/iam/types.go:54

	}
	return statements, nil
}

type IAMModelContext struct {
	// AWSAccountID holds the 12 digit AWS account ID, when running on AWS
	AWSAccountID string
	// AWSPartition defines the partition of the AWS account, typically "aws", "aws-cn", or "aws-us-gov"
	AWSPartition string

	// Cluster holds the cluster we are working with.
	Cluster *kops.Cluster
}

// IAMNameForServiceAccountRole determines the name of the IAM Role and Instance Profile to use for the service-account role
func (b *IAMModelContext) IAMNameForServiceAccountRole(role Subject) (string, error) {
	serviceAccount, ok := role.ServiceAccount()
	if !ok {
		return "", fmt.Errorf("role %v does not have ServiceAccount", role)
	}
	name := IAMNameForServiceAccountRole(serviceAccount.Name, serviceAccount.Namespace, b.ClusterName())
	return name, nil
}

// ClusterName returns the cluster name
func (b *IAMModelContext) ClusterName() string {
	return b.Cluster.ObjectMeta.Name
}

func IAMNameForServiceAccountRole(name, namespace, clusterName string) string {
	role := name + "." + strings.ReplaceAll(namespace, "*", "wildcard") + ".sa." + clusterName
	role = truncate.TruncateString(role, truncate.TruncateStringOptions{MaxLength: MaxLengthIAMRoleName, AlwaysAddHash: false})
	return role
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure every Subject used for service-account IAM mapping includes a fully qualified serviceAccount name such as system:serviceaccount:<namespace>:<name>
2. Remove non-service-account subjects from the IAM/serviceAccount role mappings in the cluster spec
3. Edit the cluster with `kops edit cluster` and re-run `kops update cluster` to validate

When it happens

Trigger: Thrown at pkg/model/iam/types.go:54 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a896673472af408f. Report an issue: GitHub.