{"record":{"id":"c4e1602306a5a0a8","repo":"kubernetes/kops","slug":"creating-nlb-target-group-w","errorCode":null,"errorMessage":"creating NLB target group: %w","messagePattern":"creating NLB target group: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/targetgroup.go","lineNumber":376,"sourceCode":"\t\t}\n\n\t\trequest := &elbv2.CreateTargetGroupInput{\n\t\t\tName:                       &createTargetGroupName,\n\t\t\tPort:                       e.Port,\n\t\t\tProtocol:                   e.Protocol,\n\t\t\tVpcId:                      e.VPC.ID,\n\t\t\tHealthCheckIntervalSeconds: e.Interval,\n\t\t\tHealthyThresholdCount:      e.HealthyThreshold,\n\t\t\tUnhealthyThresholdCount:    e.UnhealthyThreshold,\n\t\t\tHealthCheckProtocol:        e.HealthCheckProtocol,\n\t\t\tHealthCheckPath:            e.HealthCheckPath,\n\t\t\tTags:                       awsup.ELBv2Tags(tags),\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Target Group for NLB\")\n\t\tresponse, err := t.Cloud.ELBV2().CreateTargetGroup(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating NLB target group: %w\", err)\n\t\t}\n\n\t\tif err := ModifyTargetGroupAttributes(ctx, t.Cloud, response.TargetGroups[0].TargetGroupArn, e.Attributes); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// Avoid spurious changes\n\t\te.ARN = response.TargetGroups[0].TargetGroupArn\n\n\t\t// TODO: Set revision or info?\n\t} else {\n\t\tif a.ARN != nil {\n\t\t\tif err := t.AddELBV2Tags(fi.ValueOf(a.ARN), e.Tags); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := ModifyTargetGroupAttributes(ctx, t.Cloud, a.ARN, e.Attributes); err != nil {\n\t\t\t\treturn err\n\t\t\t}","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/targetgroup.go#L358-L394","documentation":"RenderAWS for a non-shared TargetGroup calls the AWS ELBV2 CreateTargetGroup API and this wraps any API error. The failure means AWS rejected target group creation (invalid VPC, bad protocol/port, permissions, rate limits, etc.), not a kOps-side logic problem.","triggerScenarios":"`kops update cluster` rendering a new NLB target group where CreateTargetGroup returns an error: invalid subnet/VPC, unsupported protocol, invalid port range, missing elasticloadbalancing:CreateTargetGroup permission, or API throttling.","commonSituations":"IAM policy lacking elbv2 write permissions; VPC/subnet deleted or misconfigured in the spec; protocol (TCP/UDP/HTTP) mismatch with NLB type; AWS API throttling during large applies.","solutions":["Read the wrapped %w cause for the exact AWS error code and address it (InvalidPermissions, throttling, etc.)","Verify IAM role includes elasticloadbalancing:CreateTargetGroup and related elbv2 permissions","Confirm the VPC/subnets referenced by the NLB/target group still exist and match the cluster spec","Re-run the apply after transient AWS errors (throttling/5xx)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check IAM and quota before apply\n// aws iam simulate-principal-policy --policy-source-arn <role> --action-names elasticloadbalancing:CreateTargetGroup\n// aws elbv2 describe-account-limits","typeGuard":null,"tryCatchPattern":"if err := applyCluster(); err != nil {\n  if strings.Contains(err.Error(), \"creating NLB target group\") {\n    var terr smithy.APIError\n    if errors.As(err, &terr) {\n      switch terr.ErrorCode() {\n      case \"ThrottlingException\": time.Sleep(backoff) // then retry\n      case \"AccessDenied\": fixIAM()\n      default: log.Printf(\"fix spec: %v\", terr.ErrorMessage())\n      }\n    }\n  }\n}","preventionTips":["Grant elbv2 create/modify permissions to the kops IAM role","Validate protocol/port against NLB type before apply","Retry applies on transient AWS errors","Keep VPC/subnet refs in the spec current"],"tags":["aws","elbv2","target-group","api-error"],"backgroundTag":"aws-api-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}