kubernetes/kops · error

creating listener for NLB on port %v: %w

Error message

creating listener for NLB on port %v: %w

What it means

This error wraps a failure from the AWS ELBV2 CreateListener API while provisioning a Network Load Balancer listener for a specific port. It is thrown when kOps' RenderAWS task tries to create a listener (TCP/TLS/UDP) and AWS rejects or fails the request, preserving the underlying AWS error via %w. Common root causes are security-group, subnet, certificate (ACM), or quota issues on the NLB.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go:207

		}

		if e.SSLCertificateID != "" {
			request.Certificates = []elbv2types.Certificate{}
			request.Certificates = append(request.Certificates, elbv2types.Certificate{
				CertificateArn: aws.String(e.SSLCertificateID),
			})
			request.Protocol = elbv2types.ProtocolEnumTls
			if e.SSLPolicy != "" {
				request.SslPolicy = aws.String(e.SSLPolicy)
			}
		} else {
			request.Protocol = elbv2types.ProtocolEnumTcp
		}

		klog.V(2).Infof("Creating Listener for NLB with port %v", e.Port)
		_, err := t.Cloud.ELBV2().CreateListener(ctx, request)
		if err != nil {
			return fmt.Errorf("creating listener for NLB on port %v: %w", e.Port, err)
		}
	}

	return nil
}

type terraformNetworkLoadBalancerListener struct {
	LoadBalancer   *terraformWriter.Literal                     `cty:"load_balancer_arn"`
	Port           int64                                        `cty:"port"`
	Protocol       elbv2types.ProtocolEnum                      `cty:"protocol"`
	CertificateARN *string                                      `cty:"certificate_arn"`
	SSLPolicy      *string                                      `cty:"ssl_policy"`
	DefaultAction  []terraformNetworkLoadBalancerListenerAction `cty:"default_action"`
}

type terraformNetworkLoadBalancerListenerAction struct {
	Type           elbv2types.ActionTypeEnum `cty:"type"`
	TargetGroupARN *terraformWriter.Literal  `cty:"target_group_arn"`

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error code in the message to identify the underlying cause
2. Ensure no existing listener already occupies the same port on the target NLB
3. Verify the certificateArn is valid and in the same region for TLS listeners
4. Check NLB listener quota in the region and request an increase if needed
5. Confirm the IAM role has elasticloadbalancing:CreateListener permission

Example fix

// before: TLS listener with missing cert
apiVersion: kops/v1alpha2
kind: LoadBalancer
spec:
  tls:
    certificateArn: arn:aws:acm:us-east-1:123:nonexistent
// after
spec:
  tls:
    certificateArn: arn:aws:acm:us-east-1:123456789012:certificate/abcd-1234

// Go: pre-check listener port availability on the NLB
import "github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2"
func portFree(ctx context.Context, c *elasticloadbalancingv2.Client, lbArn string, port int32) error {
	o, err := c.DescribeListeners(ctx, &elasticloadbalancingv2.DescribeListenersInput{LoadBalancerArn: &lbArn})
	if err != nil { return err }
	for _, l := range o.Listeners {
		if l.Port != nil && *l.Port == port {
			return fmt.Errorf("port %d already in use on NLB %s", port, lbArn)
		}
	}
	return nil
}

err := renderNLBListener(...)
var oe *fs.PathError // replace with AWS smithy APIError
var apiErr smithy.APIError
if err != nil {
    if errors.As(err, &apiErr) {
        switch apiErr.ErrorCode() {
        case "InvalidConfigurationRequest": // port in use / bad cert
        case "CertificateNotFound":       // fix ACM ARN
        default: // generic failure
        }
    }
    return fmt.Errorf("creating listener for NLB on port %v: %w", port, err)
}

When it happens

Trigger: Calling CreateListener with a port already in use by another listener on the same NLB, an invalid certificate ARN for TLS listeners, a subnet/security-group problem, or hitting the AWS listener quota per NLB (50 by default).

Common situations: Reusing a port across multiple kops-managed NLB listeners; specifying an ACM cert ARN that doesn't exist or belongs to another region; exceeding listeners-per-NLB quota; permission issues on the IAM role.

Related errors

• error deleting V2 LoadBalancer %q: %v
• error mapping DNSName %q to LoadBalancer: %v
• Found NLB %q linked to DNS name %q, but it did not have a Na
• error configuring NLB attributes for NLB %q: %v
• looking for AWS NLB: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d0874eb0be4d7ed6. Report an issue: GitHub.