kubernetes/kops · error

updating Role Assignment is not yet implemented

Error message

updating Role Assignment is not yet implemented

What it means

RoleAssignment RenderAzure only supports creating a new assignment (when no existing assignment `a` is found) or no-op. If the observed assignment exists and the diff contains changes to both ID and RoleDefID, it means kops would need to mutate an existing role assignment — an operation the Azure SDK task layer does not implement — so it fails fast.

Source

Thrown at upup/pkg/fi/cloudup/azuretasks/roleassignment.go:158

			return fi.RequiredField("Name")
		}
		return nil
	}

	// Check if unchangeable fields won't be changed.
	if changes.Name != nil {
		return fi.CannotChangeField("Name")
	}
	return nil
}

// RenderAzure creates or updates a Role Assignment.
func (*RoleAssignment) RenderAzure(t *azure.AzureAPITarget, a, e, changes *RoleAssignment) error {
	if a == nil {
		return createNewRoleAssignment(t, e)
	}
	if changes.ID != nil && changes.RoleDefID != nil {
		return errors.New("updating Role Assignment is not yet implemented")
	}
	return nil
}

func createNewRoleAssignment(t *azure.AzureAPITarget, e *RoleAssignment) error {
	// We generate the name of Role Assignment here. It must be a valid GUID.
	roleAssignmentName := uuid.New().String()

	scope := *e.Scope
	roleDefID := fmt.Sprintf("%s/providers/Microsoft.Authorization/roleDefinitions/%s", scope, *e.RoleDefID)
	roleAssignment := authz.RoleAssignmentCreateParameters{
		Properties: &authz.RoleAssignmentProperties{
			RoleDefinitionID: to.Ptr(roleDefID),
			PrincipalID:      e.VMScaleSet.PrincipalID,
		},
	}
	ra, err := t.Cloud.RoleAssignment().Create(context.TODO(), scope, roleAssignmentName, roleAssignment)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

  1. Delete the existing role assignment in Azure (az role assignment delete) and let the next kops update create it anew with the desired role
  2. Revert the role assignment change in the cluster spec so no update is required
  3. Manually create the new assignment, which makes `a` match the expected value so RenderAzure becomes a no-op
  4. Extend RenderAzure to delete-and-recreate the assignment if you maintain a kops fork

Example fix

// before: changing role on existing assignment causes the error
// after: delete then re-apply
az role assignment delete --assignee <principal-id> --role "Contributor"
kops update cluster <name> --yes
Defensive patterns

Strategy: validation

Validate before calling

if existing != nil && desired.RoleDefID != existing.RoleDefID {
	// need delete + recreate, update is unsupported
	azRoleAssignmentDelete(existing); createNew(desired)
}

Try / catch

if err := ra.RenderAzure(target, a, e, changes); err != nil {
	if strings.Contains(err.Error(), "updating Role Assignment is not yet implemented") {
		// delete existing assignment then re-run update
	} else { return err }
}

Prevention

When it happens

Trigger: kops update cluster against Azure when an existing RoleAssignment's roleDefinitionId must change (e.g. the role assigned to the cluster's identity changed), producing changes to ID and RoleDefID in RenderAzure.

Common situations: Changing which Azure role (e.g. Contributor vs Network Contributor) is bound to the cluster's managed identity after the cluster was created; editing role assignment fields in a Terraform-applied cluster and re-running update; drift between applied and desired role assignments.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6e957e39f3cb44b0. Report an issue: GitHub.