{"record":{"id":"049e027a569a92f4","repo":"kubernetes/kops","slug":"error-mapping-dnsname-q-to-loadbalancer-v","errorCode":null,"errorMessage":"error mapping DNSName %q to LoadBalancer: %v","messagePattern":"error mapping DNSName %q to LoadBalancer: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnsname.go","lineNumber":144,"sourceCode":"\t}\n\n\treturn actual, nil\n}\n\nfunc findDNSTarget(cloud awsup.AWSCloud, aliasTarget *route53types.AliasTarget, dnsName string, targetDNSName *string) (DNSTarget, error) {\n\tif NLB, err := findDNSTargetNLB(cloud, aliasTarget, dnsName, targetDNSName); err != nil {\n\t\treturn nil, err\n\t} else if NLB != nil {\n\t\treturn NLB, nil\n\t}\n\n\treturn nil, nil\n}\n\nfunc findDNSTargetNLB(cloud awsup.AWSCloud, aliasTarget *route53types.AliasTarget, dnsName string, targetDNSName *string) (DNSTarget, error) {\n\tlb, err := findNetworkLoadBalancerByAlias(cloud, aliasTarget)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error mapping DNSName %q to LoadBalancer: %v\", dnsName, err)\n\t}\n\tif lb != nil {\n\t\tloadBalancerName := aws.ToString(lb.LoadBalancerName) // TODO: can we keep these on object\n\t\tloadBalancerArn := aws.ToString(lb.LoadBalancerArn)   // TODO: can we keep these on object\n\t\ttagMap, err := cloud.DescribeELBV2Tags([]string{loadBalancerArn})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttags := tagMap[loadBalancerArn]\n\t\tnameTag, _ := awsup.FindELBV2Tag(tags, \"Name\")\n\t\tif nameTag == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"Found NLB %q linked to DNS name %q, but it did not have a Name tag\", loadBalancerName, fi.ValueOf(targetDNSName))\n\t\t}\n\t\treturn &NetworkLoadBalancer{Name: new(nameTag)}, nil\n\t}\n\treturn nil, nil\n}\n","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnsname.go#L126-L162","documentation":"findDNSTargetNLB resolves a Route53 alias target back to an NLB by calling findNetworkLoadBalancerByAlias (ELBV2 DescribeLoadBalancers). When that lookup errors, kops wraps it as 'error mapping DNSName %q to LoadBalancer' (dnsname.go:144). This happens while reading current state in Find, so the DNS alias points at a load balancer kops could not resolve.","triggerScenarios":"findNetworkLoadBalancerByAlias returns an error: ELBV2 API denied (no elasticloadbalancing:DescribeLoadBalancers), throttled, or a credential/region mismatch for the ELBV2 endpoint while matching aliasTarget DNSName/HostedZoneId against listed load balancers.","commonSituations":"IAM policy missing ELBV2 describe permissions; NLB deleted or moved to another account/region; API throttling when many records are resolved at once; misconfigured region in kops credentials.","solutions":["Inspect the wrapped error from findNetworkLoadBalancerByAlias for the AWS cause","If AccessDenied: grant elasticloadbalancing:DescribeLoadBalancers and DescribeTags to the kops credentials","If throttling: retry with backoff or run kops update during lower API activity","Confirm the NLB and Route53 zone are in the same account/region as the kops credentials","If the NLB was manually deleted, remove or repair the alias record"],"exampleFix":"// before: policy without ELBV2 read\n{\"Action\": [\"ec2:*\", \"route53:*\"]}\n// after\n{\"Action\": [\"ec2:*\", \"route53:*\", \"elasticloadbalancing:DescribeLoadBalancers\", \"elasticloadbalancing:DescribeTags\"], \"Effect\": \"Allow\", \"Resource\": \"*\"}","handlingStrategy":"try-catch","validationCode":"// Confirm ELBV2 read access before resolving the alias\n_, err := cloud.ELBV2().DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{PageSize: aws.Int32(1)})\nif err != nil {\n\treturn fmt.Errorf(\"ELBV2 describe denied/failing (check region + IAM): %w\", err)\n}","typeGuard":null,"tryCatchPattern":"target, err := findDNSTarget(cloud, aliasTarget, dnsName, resourceName)\nif err != nil {\n\tif strings.Contains(err.Error(), \"AccessDenied\") {\n\t\t// fix IAM: elasticloadbalancing:DescribeLoadBalancers\n\t} else if strings.Contains(err.Error(), \"Throttling\") {\n\t\t// back off and retry\n\t}\n\treturn err\n}","preventionTips":["Grant elasticloadbalancing:DescribeLoadBalancers and DescribeTags to kops credentials","Keep the NLB, Route53 zone, and kops credentials in the same account/region","Avoid running many kops operations concurrently to prevent ELBV2 throttling","Verify the alias's underlying NLB still exists before kops runs (aws elbv2 describe-load-balancers)"],"tags":["aws","elbv2","nlb","route53","alias-target","kops"],"backgroundTag":"aws-api-permission-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}