{"record":{"id":"d0874eb0be4d7ed6","repo":"kubernetes/kops","slug":"creating-listener-for-nlb-on-port-v-w","errorCode":null,"errorMessage":"creating listener for NLB on port %v: %w","messagePattern":"creating listener for NLB on port (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go","lineNumber":207,"sourceCode":"\t\t}\n\n\t\tif e.SSLCertificateID != \"\" {\n\t\t\trequest.Certificates = []elbv2types.Certificate{}\n\t\t\trequest.Certificates = append(request.Certificates, elbv2types.Certificate{\n\t\t\t\tCertificateArn: aws.String(e.SSLCertificateID),\n\t\t\t})\n\t\t\trequest.Protocol = elbv2types.ProtocolEnumTls\n\t\t\tif e.SSLPolicy != \"\" {\n\t\t\t\trequest.SslPolicy = aws.String(e.SSLPolicy)\n\t\t\t}\n\t\t} else {\n\t\t\trequest.Protocol = elbv2types.ProtocolEnumTcp\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Listener for NLB with port %v\", e.Port)\n\t\t_, err := t.Cloud.ELBV2().CreateListener(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating listener for NLB on port %v: %w\", e.Port, err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\ntype terraformNetworkLoadBalancerListener struct {\n\tLoadBalancer   *terraformWriter.Literal                     `cty:\"load_balancer_arn\"`\n\tPort           int64                                        `cty:\"port\"`\n\tProtocol       elbv2types.ProtocolEnum                      `cty:\"protocol\"`\n\tCertificateARN *string                                      `cty:\"certificate_arn\"`\n\tSSLPolicy      *string                                      `cty:\"ssl_policy\"`\n\tDefaultAction  []terraformNetworkLoadBalancerListenerAction `cty:\"default_action\"`\n}\n\ntype terraformNetworkLoadBalancerListenerAction struct {\n\tType           elbv2types.ActionTypeEnum `cty:\"type\"`\n\tTargetGroupARN *terraformWriter.Literal  `cty:\"target_group_arn\"`","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go#L189-L225","documentation":"This error wraps a failure from the AWS ELBV2 CreateListener API while provisioning a Network Load Balancer listener for a specific port. It is thrown when kOps' RenderAWS task tries to create a listener (TCP/TLS/UDP) and AWS rejects or fails the request, preserving the underlying AWS error via %w. Common root causes are security-group, subnet, certificate (ACM), or quota issues on the NLB.","triggerScenarios":"Calling CreateListener with a port already in use by another listener on the same NLB, an invalid certificate ARN for TLS listeners, a subnet/security-group problem, or hitting the AWS listener quota per NLB (50 by default).","commonSituations":"Reusing a port across multiple kops-managed NLB listeners; specifying an ACM cert ARN that doesn't exist or belongs to another region; exceeding listeners-per-NLB quota; permission issues on the IAM role.","solutions":["Check the wrapped AWS error code in the message to identify the underlying cause","Ensure no existing listener already occupies the same port on the target NLB","Verify the certificateArn is valid and in the same region for TLS listeners","Check NLB listener quota in the region and request an increase if needed","Confirm the IAM role has elasticloadbalancing:CreateListener permission"],"exampleFix":"// before: TLS listener with missing cert\napiVersion: kops/v1alpha2\nkind: LoadBalancer\nspec:\n  tls:\n    certificateArn: arn:aws:acm:us-east-1:123:nonexistent\n// after\nspec:\n  tls:\n    certificateArn: arn:aws:acm:us-east-1:123456789012:certificate/abcd-1234","handlingStrategy":"try-catch","validationCode":"// Go: pre-check listener port availability on the NLB\nimport \"github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2\"\nfunc portFree(ctx context.Context, c *elasticloadbalancingv2.Client, lbArn string, port int32) error {\n\to, err := c.DescribeListeners(ctx, &elasticloadbalancingv2.DescribeListenersInput{LoadBalancerArn: &lbArn})\n\tif err != nil { return err }\n\tfor _, l := range o.Listeners {\n\t\tif l.Port != nil && *l.Port == port {\n\t\t\treturn fmt.Errorf(\"port %d already in use on NLB %s\", port, lbArn)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"err := renderNLBListener(...)\nvar oe *fs.PathError // replace with AWS smithy APIError\nvar apiErr smithy.APIError\nif err != nil {\n    if errors.As(err, &apiErr) {\n        switch apiErr.ErrorCode() {\n        case \"InvalidConfigurationRequest\": // port in use / bad cert\n        case \"CertificateNotFound\":       // fix ACM ARN\n        default: // generic failure\n        }\n    }\n    return fmt.Errorf(\"creating listener for NLB on port %v: %w\", port, err)\n}","preventionTips":["Deduplicate listener ports across all LoadBalancer specs in the cluster","Validate ACM certificate ARNs exist in the same region before applying","Monitor AWSServiceQuota for listeners-per-NLB","Grant elasticloadbalancing:CreateListener to the kOps IAM role"],"tags":["aws","nlb","elbv2","infrastructure"],"backgroundTag":"aws-elbv2-create-listener-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}