{"record":{"id":"798f33f461e2d798","repo":"kubernetes/kops","slug":"error-updating-security-groups-on-load-balancer","errorCode":null,"errorMessage":"Error updating security groups on Load Balancer: %v","messagePattern":"Error updating security groups on Load Balancer: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/network_load_balancer.go","lineNumber":614,"sourceCode":"\n\t\t\t\tklog.V(2).Infof(\"Attaching Load Balancer to new subnets\")\n\t\t\t\tif _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error attaching load balancer to new subnets: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif changes.SecurityGroups != nil {\n\t\t\trequest := &elbv2.SetSecurityGroupsInput{\n\t\t\t\tLoadBalancerArn: &loadBalancerArn,\n\t\t\t}\n\t\t\tfor _, sg := range e.SecurityGroups {\n\t\t\t\trequest.SecurityGroups = append(request.SecurityGroups, aws.ToString(sg.ID))\n\t\t\t}\n\n\t\t\tklog.V(2).Infof(\"Updating Load Balancer Security Groups\")\n\t\t\tif _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {\n\t\t\t\treturn fmt.Errorf(\"Error updating security groups on Load Balancer: %v\", err)\n\t\t\t}\n\t\t}\n\n\t\tif err := t.AddELBV2Tags(loadBalancerArn, tags); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif err := t.RemoveELBV2Tags(loadBalancerArn, tags); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tif err := e.modifyLoadBalancerAttributes(t, a, e, changes, loadBalancerArn); err != nil {\n\t\tklog.Infof(\"error modifying NLB attributes: %v\", err)\n\t\treturn err\n\t}\n\treturn nil\n}","sourceCodeStart":596,"sourceCodeEnd":632,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go#L596-L632","documentation":"This error wraps a failure from the ELBV2 SetSecurityGroups API when updating the security groups attached to a Network Load Balancer during RenderAWS. kOps collected e.SecurityGroups IDs into a SetSecurityGroupsInput and the AWS API rejected the call. The underlying AWS error string is included in the message.","triggerScenarios":"Calling SetSecurityGroups with a security group ID that doesn't exist, is in a different VPC than the NLB, exceeds the NLB SG limit, or when the account/VPC lacks permission; also when passing zero security groups.","commonSituations":"Adding a cluster security group that was deleted out-of-band; mixing SGs from peered or wrong VPC after cluster re-creation; kOps state drift where the task's SecurityGroups reference stale IDs.","solutions":["Check the wrapped AWS error for the offending security group ID","Verify all SG IDs exist and belong to the NLB's VPC (kops get instancegroups / aws ec2 describe-security-groups)","Reconcile cluster spec so e.SecurityGroups references valid SGs, then re-run kops update cluster","Recreate missing security groups or remove them from the cluster spec"],"exampleFix":"// before: stale SG id in spec\ne.SecurityGroups = []*awstasks.SecurityGroup{{ID: aws.String(\"sg-deleted123\")}}\n// after: reference the task so kOps resolves/recreates it\ne.SecurityGroups = []*awstasks.SecurityGroup{{Name: aws.String(sgName), VPC: vpcTask}}","handlingStrategy":"validation","validationCode":"for _, sg := range e.SecurityGroups {\n  out, err := cloud.EC2().DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{GroupIds: []string{*sg.ID}})\n  if err != nil || len(out.SecurityGroups) == 0 { return fmt.Errorf(\"SG %s missing\", *sg.ID) }\n}","typeGuard":null,"tryCatchPattern":"if _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {\n  var nf *elbv2types.SecurityGroupNotFoundException\n  if errors.As(err, &nf) { /* recreate SGs then retry */ }\n  return fmt.Errorf(\"Error updating security groups on Load Balancer: %v\", err)\n}","preventionTips":["Reference SGs as kOps tasks, not hard-coded IDs","Keep all SGs in the same VPC as the NLB","Avoid manual console edits to cluster-managed SGs","Check SG count stays within the NLB limit (typically 5)"],"tags":["aws","elbv2","load-balancer","security-group"],"backgroundTag":"nlb-security-group-update-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}