kubernetes/kops · error

ServiceAccount-level IAM is not yet supported on cloud %T

Error message

ServiceAccount-level IAM is not yet supported on cloud %T

What it means

AddServiceAccountRole was called for a cloud provider with no service-account-level IAM integration implemented (currently only AWS has one); the cloud type is printed via %T, and the pod-spec mutation cannot proceed.

Source

Thrown at pkg/model/iam/subject.go:116

		return &NodeRoleNode{
			enableLifecycleHookPermissions: enableLifecycleHookPermissions,
		}, nil
	case kops.InstanceGroupRoleBastion:
		return &NodeRoleBastion{}, nil
	default:
		return nil, fmt.Errorf("unknown instancegroup role %q", igRole)
	}
}

// AddServiceAccountRole adds the appropriate mounts / env vars to enable a pod to use a service-account role
func AddServiceAccountRole(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {
	cloudProvider := context.Cluster.GetCloudProvider()

	switch cloudProvider {
	case kops.CloudProviderAWS:
		return addServiceAccountRoleForAWS(context, podSpec, serviceAccountRole)
	default:
		return fmt.Errorf("ServiceAccount-level IAM is not yet supported on cloud %T", cloudProvider)
	}
}

func addServiceAccountRoleForAWS(context *IAMModelContext, podSpec *corev1.PodSpec, serviceAccountRole Subject) error {
	roleName, err := context.IAMNameForServiceAccountRole(serviceAccountRole)
	if err != nil {
		return err
	}

	awsRoleARN := "arn:" + context.AWSPartition + ":iam::" + context.AWSAccountID + ":role/" + roleName
	tokenDir := "/var/run/secrets/amazonaws.com/" //nolint:gosec // This is the projected token directory path, not a credential.
	tokenName := "token"

	volume := corev1.Volume{
		Name: "token-amazonaws-com",
	}

	mode := int32(0o644)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use node-level IAM for the unsupported cloud provider
2. Remove the serviceAccountRole configuration from the pod spec on this cloud
3. Track upstream support for the provider

When it happens

Trigger: Thrown at pkg/model/iam/subject.go:116 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c87e9c1b14a65642. Report an issue: GitHub.