{"record":{"id":"24a4598acc38a4a2","repo":"kubernetes/kops","slug":"looking-for-aws-nlb-w","errorCode":null,"errorMessage":"looking for AWS NLB: %w","messagePattern":"looking for AWS NLB: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":1960,"sourceCode":"\t\treturn nil, fmt.Errorf(\"error finding aws DNSName: %v\", err)\n\t} else if lbDnsName != \"\" {\n\t\tingresses = append(ingresses, fi.ApiIngressStatus{Hostname: lbDnsName})\n\t}\n\n\treturn ingresses, nil\n}\n\nfunc findDNSName(cloud AWSCloud, cluster *kops.Cluster) (string, error) {\n\tctx := context.TODO()\n\n\tname := \"api.\" + cluster.Name\n\tif cluster.Spec.API.LoadBalancer == nil {\n\t\treturn \"\", nil\n\t}\n\tif cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork {\n\t\tallLoadBalancers, err := ListELBV2LoadBalancers(ctx, cloud)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"looking for AWS NLB: %w\", err)\n\t\t}\n\n\t\tlatest := FindLatestELBV2ByNameTag(allLoadBalancers, name)\n\t\tif latest != nil {\n\t\t\treturn aws.ToString(latest.LoadBalancer.DNSName), nil\n\t\t}\n\t}\n\treturn \"\", nil\n}\n\n// DefaultInstanceType determines an instance type for the specified cluster & instance group\nfunc (c *awsCloudImplementation) DefaultInstanceType(cluster *kops.Cluster, ig *kops.InstanceGroup) (string, error) {\n\tvar candidates []ec2types.InstanceType\n\n\tswitch {\n\tcase ig.Spec.Role.HasNode() || ig.Spec.Role.IsControlPlaneType():\n\t\t// t3.medium is the cheapest instance with 4GB of mem, unlimited by default, fast and has decent network\n\t\t// c5.large and c4.large are a good second option in case t3.medium is not available in the AZ","sourceCodeStart":1942,"sourceCodeEnd":1978,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L1942-L1978","documentation":"In findDNSName (aws_cloud.go), when the cluster API load balancer class is Network (NLB), kOps lists all ELBv2 load balancers to locate the cluster's NLB DNS name. If ListELBV2LoadBalancers fails, the error is wrapped as 'looking for AWS NLB: %w'. It indicates the AWS elasticloadbalancingv2 API call itself failed, not that the LB is merely absent.","triggerScenarios":"cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork and ListELBV2LoadBalancers(ctx, cloud) returns an error from ec2/ELBv2 DescribeLoadBalancers — e.g. AuthFailure, throttling, invalid region, network timeout.","commonSituations":"IAM policy missing elasticloadbalancing:DescribeLoadBalancers; AWS API throttling in accounts with many load balancers (kOps paginates through all of them); misconfigured AWS_REGION or unavailable AWS endpoint (e.g. air-gapped environments, VPC endpoint misconfig).","solutions":["Test credentials/permissions: run aws elbv2 describe-load-balancers with the same credentials kOps uses.","If throttled (TooManyRequestsException / Throttling), retry with backoff or reduce API call frequency.","Verify region configuration on the AWSCloud object matches the cluster's region.","Check network path to the ELBv2 endpoint (VPC endpoints, proxy, DNS).","Confirm no IAM SCP or permission boundary denies elasticloadbalancing read actions."],"exampleFix":"// before: retrying immediately makes throttling worse\nlb, err := ListELBV2LoadBalancers(ctx, cloud)\n// after: backoff on throttling errors\nvar lbErr error\nfor i := 0; i < 3; i++ {\n    if _, lbErr = ListELBV2LoadBalancers(ctx, cloud); lbErr == nil || !isThrottlingError(lbErr) { break }\n    time.Sleep(time.Duration(1<<i) * time.Second)\n}","handlingStrategy":"retry","validationCode":"creds ok := aws elbv2 describe-load-balancers --region <region> --output text; if it fails with AccessDenied, fix IAM before invoking kops.","typeGuard":null,"tryCatchPattern":"ingresses, err := getApiIngressStatus(cloud, cluster)\nif err != nil && strings.Contains(err.Error(), \"looking for AWS NLB\") {\n    if isThrottlingOrTransient(errors.Unwrap(err)) {\n        backoff.Retry(func() error { _, err = getApiIngressStatus(cloud, cluster); return err }, backoff.NewExponentialBackOff())\n    }\n}","preventionTips":["Include elasticloadbalancing:DescribeLoadBalancers in the kops IAM policy.","Keep the number of load balancers in the account bounded or scope permissions to tags.","Configure retries/backoff in the AWS SDK session used by kOps.","Verify region and endpoint connectivity before running cluster operations."],"tags":["aws","nlb","elbv2","iam","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}