kubernetes/kops · error

unable to parse role arn %q

Error message

unable to parse role arn %q

What it means

A non-empty ARN was supplied to FindCustomAuthNameFromArn, but the trailing-segment regex `([^/]+$)` found no match, meaning the string is not shaped like an ARN with a final path segment. The input at fault is the custom ARN configured for the instance profile.

Source

Thrown at pkg/model/names.go:169

	default:
		klog.Fatalf("unknown InstanceGroup Role: %q", role)
	}
	return truncate.TruncateString(rolename, truncate.TruncateStringOptions{MaxLength: iam.MaxLengthIAMRoleName, AlwaysAddHash: false})
}

var roleNamRegExp = regexp.MustCompile(`([^/]+$)`)

// FindCustomAuthNameFromArn parses the name of a instance profile from the arn
func FindCustomAuthNameFromArn(arn string) (string, error) {
	if arn == "" {
		return "", fmt.Errorf("unable to parse role arn as it is not set")
	}
	rs := roleNamRegExp.FindStringSubmatch(arn)
	if len(rs) >= 2 {
		return rs[1], nil
	}

	return "", fmt.Errorf("unable to parse role arn %q", arn)
}

func (b *KopsModelContext) LinkToIAMInstanceProfile(ig *kops.InstanceGroup) (*awstasks.IAMInstanceProfile, error) {
	if ig.Spec.IAM != nil && ig.Spec.IAM.Profile != nil {
		name, err := FindCustomAuthNameFromArn(fi.ValueOf(ig.Spec.IAM.Profile))
		return &awstasks.IAMInstanceProfile{Name: &name}, err
	}
	name := b.IAMName(ig.Spec.Role)
	return &awstasks.IAMInstanceProfile{Name: &name}, nil
}

// SSHKeyName computes a unique SSH key name, combining the cluster name and the SSH public key fingerprint.
// If an SSH key name is provided in the cluster configuration, it will use that instead.
func (b *KopsModelContext) SSHKeyName() (string, error) {
	// use configured SSH key name if present
	sshKeyName := b.Cluster.Spec.SSHKeyName
	if sshKeyName != nil && *sshKeyName != "" {
		return *sshKeyName, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the configured ARN to a well-formed one ending in a role name (e.g. arn:aws:iam::123456789012:role/my-role)
2. Copy the ARN verbatim from the AWS IAM console to avoid truncation or whitespace

When it happens

Trigger: Thrown at pkg/model/names.go:169 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/03712c13c6a655b0. Report an issue: GitHub.