kubernetes/kops · error
unable to parse instance profile name from arn %q: %v
Error message
unable to parse instance profile name from arn %q: %v
What it means
kOps needs the instance profile NAME (not the full ARN) to build IAM tasks for a custom profile. When spec.iam.profile contains an ARN whose name segment cannot be extracted by FindCustomAuthNameFromArn (malformed ARN, wrong resource type, or not an instance-profile ARN at all), Build wraps the parse error with this message.
Source
Thrown at pkg/model/awsmodel/iam.go:100
for profileARN, igRole := range sharedProfileARNsToIGRole {
lchPermissions := false
defaultWarmPool := b.Cluster.Spec.CloudProvider.AWS.WarmPool
for _, ig := range b.InstanceGroups {
warmPool := defaultWarmPool.ResolveDefaults(ig)
if ig.Spec.Role == igRole && warmPool.IsEnabled() && warmPool.EnableLifecycleHook {
lchPermissions = true
break
}
}
role, err := iam.BuildNodeRoleSubject(igRole, lchPermissions)
if err != nil {
return err
}
iamName, err := model.FindCustomAuthNameFromArn(profileARN)
if err != nil {
return fmt.Errorf("unable to parse instance profile name from arn %q: %v", profileARN, err)
}
err = b.buildIAMTasks(role, iamName, c, true)
if err != nil {
return err
}
}
// Generate IAM tasks for each managed role
defaultWarmPool := b.Cluster.Spec.CloudProvider.AWS.WarmPool
for igRole := range managedRoles {
haveWarmPool := false
for _, ig := range b.InstanceGroups {
warmPool := defaultWarmPool.ResolveDefaults(ig)
if ig.Spec.Role == igRole && warmPool.IsEnabled() && warmPool.EnableLifecycleHook {
haveWarmPool = true
break
}View on GitHub (pinned to 4c8573c808)
Solutions
- Verify the value is a full instance-profile ARN of the form arn:aws:iam::<account>:instance-profile/<name> and fix typos.
- Replace the ARN with just the instance profile name if supported, or re-copy the ARN from `aws iam list-instance-profiles`.
- If using a path, simplify to a profile without a path segment.
Example fix
// before iam: profile: arn:aws:iam::123456789012:role/MyRole // after iam: profile: arn:aws:iam::123456789012:instance-profile/MyProfile
Defensive patterns
Strategy: validation
Validate before calling
re := regexp.MustCompile(`^arn:aws[a-zA-Z-]*:iam::\d{12}:instance-profile/([A-Za-z0-9+=,.@_-]+)$`)
if !re.MatchString(profileARN) {
return fmt.Errorf("not a valid instance-profile ARN: %s", profileARN)
} Prevention
- Copy profile ARNs from `aws iam get-instance-profile --instance-profile-name <name>` rather than hand-typing.
- Never use a role ARN where an instance profile ARN is required.
- Lint kops manifests in CI for iam.profile values matching the instance-profile ARN pattern.
When it happens
Trigger: Setting spec.iam.profile on an InstanceGroup to a malformed string (e.g. missing the trailing instance-profile path), to a role ARN instead of an instance-profile ARN, or to a truncated/partially-typed ARN.
Common situations: Users paste the ARN of the underlying IAM Role instead of the Instance Profile; extra path suffixes like :instance-profile/team/foo/bar that the parser does not expect; typos introduced while copying from the AWS console.
Understand the failure class
- Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.
Related errors
- found IAM instance profile assigned to multiple Instance Gro
- IP version is incorrect
- provider ID cannot be empty
- provider ID number cannot be empty
- error listing hosted zones: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/d2521b690fe9e337.
Report an issue: GitHub.