{"record":{"id":"55d933a95836a5c4","repo":"kubernetes/kops","slug":"load-balancer-not-yet-ready-arn-is-empty","errorCode":null,"errorMessage":"load balancer not yet ready (arn is empty)","messagePattern":"load balancer not yet ready \\(arn is empty\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/targetgroup.go","lineNumber":335,"sourceCode":"\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\treturn nil\n\t}\n\n\ttags := make(map[string]string)\n\tfor k, v := range e.Tags {\n\t\ttags[k] = v\n\t}\n\tif a != nil {\n\t\tif a.revision != \"\" {\n\t\t\ttags[awsup.KopsResourceRevisionTag] = a.revision\n\t\t}\n\t}\n\n\tif e.networkLoadBalancer != nil {\n\t\tif e.networkLoadBalancer.loadBalancerArn == \"\" {\n\t\t\treturn fmt.Errorf(\"load balancer not yet ready (arn is empty)\")\n\t\t}\n\t\tnlbRevision := e.networkLoadBalancer.revision\n\t\tif nlbRevision != \"\" {\n\t\t\ttags[awsup.KopsResourceRevisionTag] = nlbRevision\n\t\t}\n\t}\n\n\t// You register targets for your Network Load Balancer with a target group. By default, the load balancer sends requests\n\t// to registered targets using the port and protocol that you specified for the target group. You can override this port\n\t// when you register each target with the target group.\n\n\tif a == nil {\n\t\tcreateTargetGroupName := *e.Name\n\t\tif tags[awsup.KopsResourceRevisionTag] != \"\" {\n\t\t\ts := *e.Name + tags[awsup.KopsResourceRevisionTag]\n\t\t\t// We always compute the hash and add it, lest we trick users into assuming that we never do this\n\t\t\topt := truncate.TruncateStringOptions{\n\t\t\t\tMaxLength:     32,","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/targetgroup.go#L317-L353","documentation":"During RenderAWS of a TargetGroup task, the task carries a reference to its parent NetworkLoadBalancer, but the NLB has not been created yet so its loadBalancerArn is empty. Since target groups for NLBs are created in the NLB's VPC and tagged with the NLB's revision, kOps refuses to proceed rather than creating a target group tied to a non-existent load balancer. This is an ordering/dependency guard within a single cloudup apply run.","triggerScenarios":"Running `kops update cluster` with a NetworkLoadBalancer-backed service where the NLB task has not yet been rendered/created before the TargetGroup task's RenderAWS executes, so e.networkLoadBalancer.loadBalancerArn is still the empty string.","commonSituations":"First-time cluster bring-up or adding an NLB-backed load balancer where task dependency ordering fails; a partially-failed apply that created the target group reconciliation pass before the NLB; custom builds where NLB task ordering changed.","solutions":["Re-run `kops update cluster` — the NLB is usually created in a prior pass and the ARN will then be populated","Check that the LoadBalancer task (networkLoadBalancer) is correctly wired to the TargetGroup so fi task dependencies enforce ordering","If persistent, inspect the NLB task in the cluster spec (kubectl.kubernetes.io/last-applied / kops get) for a failed NLB creation and fix the underlying NLB creation error","Upgrade kOps — NLB/target-group ordering bugs have been fixed over releases"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// before apply: ensure NLB task is resolvable and will be created in the same run\nnlb := findTask(t, &awstasks.NetworkLoadBalancer{})\nif nlb == nil { return errors.New(\"NLB task missing from target; cannot create target group\") }","typeGuard":"if e.networkLoadBalancer != nil && e.networkLoadBalancer.loadBalancerArn != \"\" {\n  // safe to proceed\n}","tryCatchPattern":null,"preventionTips":["Keep NLB and TargetGroup tasks in one apply so fi dependency ordering creates the NLB first","Re-run `kops update cluster` when this appears — it usually resolves on the next pass","Never hand-edit the state store to inject ARNs","Track kOps releases for NLB ordering fixes"],"tags":["aws","nlb","target-group","apply-ordering"],"backgroundTag":"load-balancer-not-ready","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}