{"record":{"id":"742705705627f86a","repo":"kubernetes/kops","slug":"failed-to-register-instance-from-targetgroups-w","errorCode":null,"errorMessage":"failed to register instance from targetGroups: %w","messagePattern":"failed to register instance from targetGroups: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awsup/aws_cloud.go","lineNumber":610,"sourceCode":"\t\ttime.Sleep(5 * time.Second)\n\t}\n\treturn nil\n}\n\n// deregisterInstanceFromTargetGroups ensures that instances are fully unused in the corresponding targetGroups before instance termination.\n// this ensures that connections are fully drained from the instance before terminating.\nfunc deregisterInstanceFromTargetGroups(ctx context.Context, c AWSCloud, targetGroupArns []string, instanceId string) error {\n\teg, _ := errgroup.WithContext(context.Background())\n\n\tfor _, targetGroupArn := range targetGroupArns {\n\t\tarn := targetGroupArn\n\t\teg.Go(func() error {\n\t\t\treturn deregisterInstanceFromTargetGroup(ctx, c, arn, instanceId)\n\t\t})\n\t}\n\n\tif err := eg.Wait(); err != nil {\n\t\treturn fmt.Errorf(\"failed to register instance from targetGroups: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc deregisterInstanceFromTargetGroup(ctx context.Context, c AWSCloud, targetGroupArn string, instanceId string) error {\n\tklog.Infof(\"Deregistering instance from targetGroup: %s\", targetGroupArn)\n\n\tfor {\n\t\tinstanceDraining := false\n\n\t\tresponse, err := c.ELBV2().DescribeTargetHealth(ctx, &elbv2.DescribeTargetHealthInput{\n\t\t\tTargetGroupArn: aws.String(targetGroupArn),\n\t\t\tTargets: []elbv2types.TargetDescription{{\n\t\t\t\tId: aws.String(instanceId),\n\t\t\t}},\n\t\t})\n\t\tif err != nil {","sourceCodeStart":592,"sourceCodeEnd":628,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awsup/aws_cloud.go#L592-L628","documentation":"deregisterInstanceFromTargetGroups fans out one goroutine per target group ARN to drain the instance; when any of them fails, eg.Wait() aggregates the error and it is wrapped with this message. Despite saying 'register', it is emitted on the deregistration path — it means the instance could not be proven unused/drained in at least one target group before termination.","triggerScenarios":"One or more deregisterInstanceFromTargetGroup goroutines return an error (DescribeTargetHealth or DeregisterTargets failure) while draining an instance from the ASG's target groups during rolling update/delete.","commonSituations":"Missing elasticloadbalancing permissions; target group deleted out-of-band; throttling with many target groups; network errors mid-drain.","solutions":["Inspect the wrapped inner error(s) to identify the failing target group and underlying AWS error code","Verify IAM grants elasticloadbalancing:DescribeTargetHealth and elasticloadbalancing:DeregisterTargets","Confirm the target group ARNs still exist; detach stale target groups from the ASG","Retry — throttling/transient errors during the 5s polling drain loop often clear"],"exampleFix":"// before: message is confusing ('failed to register...')\n// failed to register instance from targetGroups: error deregistering target: AccessDenied\n// after: read inner cause and fix IAM\n{\"Effect\":\"Allow\",\"Action\":[\"elasticloadbalancing:DeregisterTargets\",\"elasticloadbalancing:DescribeTargetHealth\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"for _, arn := range asg.TargetGroupARNs {\n\t_, err := elbv2Svc.DescribeTargetGroups(&elbv2.DescribeTargetGroupsInput{TargetGroupArns: []string{arn}})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"target group %s unavailable before drain: %w\", arn, err)\n\t}\n}","typeGuard":"func hasTargetGroups(i *cloudinstances.CloudInstance) bool {\n\tasg, ok := i.CloudInstanceGroup.Raw.(*autoscalingtypes.AutoScalingGroup)\n\treturn ok && len(asg.TargetGroupARNs) > 0\n}","tryCatchPattern":"if err := cloud.DeregisterInstance(inst); err != nil {\n\tif strings.Contains(err.Error(), \"targetGroups\") {\n\t\t// inner cause is DescribeTargetHealth or DeregisterTargets; retry transient ones\n\t\treturn retryWithBackoff(3, 10*time.Second, func() error { return cloud.DeregisterInstance(inst) })\n\t}\n\treturn err\n}","preventionTips":["Verify IAM grants DescribeTargetHealth and DeregisterTargets","Detach deleted/stale target groups from ASGs before rolling updates","Limit parallel drains to avoid TG API throttling","Note this error text says 'register' but occurs on the deregister path"],"tags":["aws","elbv2","target-group","drain"],"backgroundTag":"target-group-deregistration-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}