kubernetes/kops · error

service account name cannot contain a wildcard %s

Error message

service account name cannot contain a wildcard %s

What it means

The service-account name used in an IAM trust-policy statement contains '*', which is disallowed: a wildcard in the name portion would grant the role to every service account in the namespace.

Source

Thrown at pkg/model/awsmodel/iam.go:408

func (b *IAMModelBuilder) buildPolicy(policyString string) (*iam.Policy, error) {
	p := &iam.Policy{
		Version: iam.PolicyDefaultVersion,
	}

	statements, err := iam.ParseStatements(policyString)
	if err != nil {
		return nil, err
	}

	p.Statement = append(p.Statement, statements...)
	return p, nil
}

func formatAWSIAMStatement(accountId, partition, oidcProvider, namespace, name string) (*iam.Statement, error) {
	// disallow wildcard in the service account name
	if strings.Contains(name, "*") {
		return nil, fmt.Errorf("service account name cannot contain a wildcard %s", name)
	}

	// if the namespace contains a wildcard, use StringLike condition instead of StringEquals
	condition := "StringEquals"
	if strings.Contains(namespace, "*") {
		condition = "StringLike"
	}

	return &iam.Statement{
			Effect: "Allow",
			Principal: iam.Principal{
				Federated: "arn:" + partition + ":iam::" + accountId + ":oidc-provider/" + oidcProvider,
			},
			Action: stringorset.String("sts:AssumeRoleWithWebIdentity"),
			Condition: map[string]interface{}{
				condition: map[string]interface{}{
					oidcProvider + ":sub": "system:serviceaccount:" + namespace + ":" + name,
				},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove wildcards from serviceAccount names in the IAM policy configuration
2. Specify the exact service account name
3. Use the namespace-wide grant form via supported config instead of a name wildcard

When it happens

Trigger: Thrown at pkg/model/awsmodel/iam.go:408 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e548ed1ec1e41e44. Report an issue: GitHub.