{"record":{"id":"88dd153721c5ac43","repo":"kubernetes/kops","slug":"error-attaching-load-balancer-to-new-subnets-v","errorCode":null,"errorMessage":"error attaching load balancer to new subnets: %v","messagePattern":"error attaching load balancer to new subnets: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/network_load_balancer.go","lineNumber":599,"sourceCode":"\t\t\t\taIP, ok := actualSubnets[*s.Subnet.ID]\n\t\t\t\tif !ok || (fi.ValueOf(s.PrivateIPv4Address) != fi.ValueOf(aIP) && fi.ValueOf(s.AllocationID) != fi.ValueOf(aIP)) {\n\t\t\t\t\thasChanges = true\n\t\t\t\t}\n\t\t\t\tawsSubnetMappings = append(awsSubnetMappings, elbv2types.SubnetMapping{\n\t\t\t\t\tSubnetId:           s.Subnet.ID,\n\t\t\t\t\tAllocationId:       s.AllocationID,\n\t\t\t\t\tPrivateIPv4Address: s.PrivateIPv4Address,\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif hasChanges {\n\t\t\t\trequest := &elbv2.SetSubnetsInput{}\n\t\t\t\trequest.LoadBalancerArn = aws.String(loadBalancerArn)\n\t\t\t\trequest.SubnetMappings = awsSubnetMappings\n\n\t\t\t\tklog.V(2).Infof(\"Attaching Load Balancer to new subnets\")\n\t\t\t\tif _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error attaching load balancer to new subnets: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif changes.SecurityGroups != nil {\n\t\t\trequest := &elbv2.SetSecurityGroupsInput{\n\t\t\t\tLoadBalancerArn: &loadBalancerArn,\n\t\t\t}\n\t\t\tfor _, sg := range e.SecurityGroups {\n\t\t\t\trequest.SecurityGroups = append(request.SecurityGroups, aws.ToString(sg.ID))\n\t\t\t}\n\n\t\t\tklog.V(2).Infof(\"Updating Load Balancer Security Groups\")\n\t\t\tif _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {\n\t\t\t\treturn fmt.Errorf(\"Error updating security groups on Load Balancer: %v\", err)\n\t\t\t}\n\t\t}\n","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/network_load_balancer.go#L581-L617","documentation":"This error wraps a failure from the AWS ELBV2 SetSubnets API call while updating a Network Load Balancer's subnets during RenderAWS. kOps detected that the NLB's subnets changed, built an elbv2.SetSubnetsInput (either Subnets or SubnetMappings), and the AWS API rejected the update. The underlying AWS error is embedded via %v.","triggerScenarios":"Calling SetSubnets with subnets in multiple non-overlapping availability zones not supported by NLB, subnets that already host the NLB, subnet mappings missing an allocation ID/EIP for static IPs, invalid subnet IDs, or an NLB in a state that disallows subnet modification.","commonSituations":"Cluster spec changes that add/remove private or utility subnets on a load-balancer-backed API server; switching between Subnets and SubnetMappings incorrectly; NLBs with static EIPs where mappings don't match new subnets; cross-zone subnets in zones without NLB support (e.g. local zones).","solutions":["Read the wrapped AWS error in %v for the exact API rejection reason","Ensure every new subnet's AZ is distinct and NLB-supported, and mappings include the correct EIP allocation IDs","Verify the NLB is active and not mid-mutation; retry after it stabilizes","Re-run kops update cluster after correcting the cluster spec subnets"],"exampleFix":"// before: mappings without EIPs for new subnets\nrequest.SubnetMappings = awsSubnetMappings // missing AllocationId entries\n// after: build mappings with static IPs for each new subnet\nfor _, s := range newSubnets {\n  awsSubnetMappings = append(awsSubnetMappings, elbv2types.SubnetMapping{\n    SubnetId: s.ID, AllocationId: aws.String(eipAllocations[*s.ID]),\n  })\n}\nrequest.SubnetMappings = awsSubnetMappings","handlingStrategy":"validation","validationCode":"// validate subnets before apply\nfor _, s := range newSubnets {\n  if err := validateSubnetInNLBSupportedAZ(s); err != nil { return err }\n}\nfor _, m := range awsSubnetMappings {\n  if m.AllocationId == nil { return fmt.Errorf(\"subnet mapping for %s missing EIP allocation\", aws.ToString(m.SubnetId)) }\n}","typeGuard":null,"tryCatchPattern":"if _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {\n  return fmt.Errorf(\"error attaching load balancer to new subnets: %v\", err)\n}\n// inspect wrapped AWS error code and retry on throttling","preventionTips":["Keep one subnet per distinct AZ in the NLB spec","Provide EIP allocation IDs whenever static IPs are used","Check NLB AZ support before adding exotic subnets (local zones)","Run kops update cluster --dry-run to inspect planned subnet changes"],"tags":["aws","elbv2","load-balancer","subnet"],"backgroundTag":"nlb-set-subnets-rejected","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}