{"record":{"id":"43696bd5a391c165","repo":"kubernetes/kops","slug":"found-nlb-q-linked-to-dns-name-q-but-it-did-not","errorCode":null,"errorMessage":"Found NLB %q linked to DNS name %q, but it did not have a Name tag","messagePattern":"Found NLB %q linked to DNS name %q, but it did not have a Name tag","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnsname.go","lineNumber":156,"sourceCode":"\treturn nil, nil\n}\n\nfunc findDNSTargetNLB(cloud awsup.AWSCloud, aliasTarget *route53types.AliasTarget, dnsName string, targetDNSName *string) (DNSTarget, error) {\n\tlb, err := findNetworkLoadBalancerByAlias(cloud, aliasTarget)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error mapping DNSName %q to LoadBalancer: %v\", dnsName, err)\n\t}\n\tif lb != nil {\n\t\tloadBalancerName := aws.ToString(lb.LoadBalancerName) // TODO: can we keep these on object\n\t\tloadBalancerArn := aws.ToString(lb.LoadBalancerArn)   // TODO: can we keep these on object\n\t\ttagMap, err := cloud.DescribeELBV2Tags([]string{loadBalancerArn})\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttags := tagMap[loadBalancerArn]\n\t\tnameTag, _ := awsup.FindELBV2Tag(tags, \"Name\")\n\t\tif nameTag == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"Found NLB %q linked to DNS name %q, but it did not have a Name tag\", loadBalancerName, fi.ValueOf(targetDNSName))\n\t\t}\n\t\treturn &NetworkLoadBalancer{Name: new(nameTag)}, nil\n\t}\n\treturn nil, nil\n}\n\nfunc (e *DNSName) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (s *DNSName) CheckChanges(a, e, changes *DNSName) error {\n\tif a == nil {\n\t\tif fi.ValueOf(e.Name) == \"\" {\n\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t\tif fi.ValueOf(e.ResourceName) == \"\" {\n\t\t\treturn fi.RequiredField(\"ResourceName\")\n\t\t}","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnsname.go#L138-L174","documentation":"After finding the NLB matching the Route53 alias, findDNSTargetNLB reads its ELBV2 tags and requires a 'Name' tag to map the load balancer back to a kops task (dnsname.go:156). If the NLB has no Name tag, kops returns this error because it cannot correlate the NLB with the cluster's load balancer task.","triggerScenarios":"An NLB exists whose DNS alias matches the Route53 record, but DescribeELBV2Tags shows no 'Name' tag — typically because the tag was removed manually, the NLB came from another tool (terraform/cloudformation) without a Name tag, or a rebuilt cluster reuses the DNS name of an old untagged NLB.","commonSituations":"Compliance/cleanup tooling strips AWS tags; a new cluster created with the same DNS name finds an old untagged NLB; an NLB created outside kops aliased into the cluster's zone; a partial apply where tagging failed earlier.","solutions":["Add a 'Name' tag to the NLB matching the kops load balancer name (aws elbv2 add-tags or EC2 console -> Load Balancers -> Tags)","Identify the intended NLB via the loadBalancerName in the error and confirm it belongs to this cluster before tagging","If the NLB is stale/foreign, delete it or fix the Route53 alias so it no longer matches","Re-run kops update cluster after tagging"],"exampleFix":"// before: untagged NLB found via alias\naws elbv2 describe-tags --resource-arns arn:aws:elasticloadbalancing:...:loadbalancer/net/xxx\n// after\naws elbv2 add-tags --resource-arns arn:aws:elasticloadbalancing:...:loadbalancer/net/xxx --tags Key=Name,Value=api.cluster.example.com","handlingStrategy":"validation","validationCode":"// Pre-check: every alias-eligible NLB must carry a Name tag\nfunc nlbHasNameTag(arn string, tags []elbv2types.Tag) error {\n\tfor _, t := range tags {\n\t\tif aws.ToString(t.Key) == \"Name\" && aws.ToString(t.Value) != \"\" {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\"NLB %s missing required 'Name' tag\", arn)\n}","typeGuard":null,"tryCatchPattern":"target, err := findDNSTarget(cloud, aliasTarget, dnsName, resourceName)\nif err != nil && strings.Contains(err.Error(), \"did not have a Name tag\") {\n\t// extract the NLB name from the message, add the Name tag, then re-run kops update\n\treturn fmt.Errorf(\"tag the NLB with Key=Name and retry: %w\", err)\n}","preventionTips":["Never strip AWS 'Name' tags with compliance/cleanup tooling on kops-managed NLBs","Ensure any externally created NLB aliased into the cluster's zone carries a Name tag","When reusing a DNS name across clusters, delete or re-tag the old NLB first","Periodically audit ELBV2 tags on load balancers (aws elbv2 describe-tags)"],"tags":["aws","nlb","elbv2","tags","route53","kops"],"backgroundTag":"missing-required-tag","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}