{"record":{"id":"ce13f87a1ddd9447","repo":"kubernetes/kops","slug":"modifying-nlb-target-group-health-check-w","errorCode":null,"errorMessage":"modifying NLB target group health check: %w","messagePattern":"modifying NLB target group health check: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/targetgroup.go","lineNumber":412,"sourceCode":"\t\t\t}\n\t\t\t// Health check settings are only applied on create, so reconcile them here for an existing target group.\n\t\t\tif changes.HealthCheckProtocol != \"\" || changes.HealthCheckPath != nil ||\n\t\t\t\tchanges.HealthyThreshold != nil || changes.UnhealthyThreshold != nil {\n\t\t\t\tklog.V(2).Infof(\"Modifying Target Group health check for NLB\")\n\t\t\t\tproto := e.HealthCheckProtocol\n\t\t\t\trequest := &elbv2.ModifyTargetGroupInput{\n\t\t\t\t\tTargetGroupArn:          a.ARN,\n\t\t\t\t\tHealthCheckProtocol:     proto,\n\t\t\t\t\tHealthyThresholdCount:   e.HealthyThreshold,\n\t\t\t\t\tUnhealthyThresholdCount: e.UnhealthyThreshold,\n\t\t\t\t}\n\t\t\t\t// HTTP/HTTPS health checks need a path and matcher, 200-399 matches the NLB create default.\n\t\t\t\tif proto == elbv2types.ProtocolEnumHttp || proto == elbv2types.ProtocolEnumHttps {\n\t\t\t\t\trequest.HealthCheckPath = e.HealthCheckPath\n\t\t\t\t\trequest.Matcher = &elbv2types.Matcher{HttpCode: new(\"200-399\")}\n\t\t\t\t}\n\t\t\t\tif _, err := t.Cloud.ELBV2().ModifyTargetGroup(ctx, request); err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"modifying NLB target group health check: %w\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc ModifyTargetGroupAttributes(ctx context.Context, cloud awsup.AWSCloud, arn *string, attributes map[string]string) error {\n\tklog.V(2).Infof(\"Modifying Target Group attributes for NLB\")\n\tattrReq := &elbv2.ModifyTargetGroupAttributesInput{\n\t\tAttributes:     []elbv2types.TargetGroupAttribute{},\n\t\tTargetGroupArn: arn,\n\t}\n\tfor k, v := range attributes {\n\t\tattrReq.Attributes = append(attrReq.Attributes, elbv2types.TargetGroupAttribute{\n\t\t\tKey:   new(k),\n\t\t\tValue: new(v),\n\t\t})","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/targetgroup.go#L394-L430","documentation":"After creating the target group, RenderAWS issues ModifyTargetGroup to configure health check settings (path, matcher, interval, timeout, healthy/unhealthy thresholds). This wraps any error from that API call. The group exists, but its health check configuration could not be applied.","triggerScenarios":"HTTP/HTTPS protocol target groups where setting HealthCheckPath or HttpCode matcher \"200-399\" is rejected, or any ELBV2 ModifyTargetGroup API error (throttling, permission, target group concurrently deleted).","commonSituations":"Invalid health check parameters (bad path, timeout > interval, thresholds out of range) in the cluster spec; IAM missing elasticloadbalancing:ModifyTargetGroup; concurrent apply/deletion racing the modify call.","solutions":["Fix the health check values in the load balancer spec (path must start with /, timeout < interval, thresholds within AWS limits)","Verify IAM permission elasticloadbalancing:ModifyTargetGroup","Re-run the apply if the cause was a transient AWS error or a concurrent modification"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// validate health check params before apply\nif proto == \"HTTP\" || proto == \"HTTPS\" {\n  if !strings.HasPrefix(path, \"/\") { return errors.New(\"HealthCheckPath must start with /\") }\n  if timeout >= interval { return errors.New(\"health check timeout must be < interval\") }\n}","typeGuard":null,"tryCatchPattern":"if err := applyCluster(); err != nil && strings.Contains(err.Error(), \"modifying NLB target group health check\") {\n  return fmt.Errorf(\"check HealthCheckPath/Matcher/timeout values in spec: %w\", err)\n}","preventionTips":["Keep timeouts < interval and thresholds within AWS allowed ranges","HealthCheckPath must begin with '/'","Include elasticloadbalancing:ModifyTargetGroup in IAM","Avoid concurrent applies against the same cluster"],"tags":["aws","elbv2","health-check","target-group"],"backgroundTag":"health-check-configuration-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}