kubernetes/kops · error

creating NLB target group: %w

Error message

creating NLB target group: %w

What it means

RenderAWS for a non-shared TargetGroup calls the AWS ELBV2 CreateTargetGroup API and this wraps any API error. The failure means AWS rejected target group creation (invalid VPC, bad protocol/port, permissions, rate limits, etc.), not a kOps-side logic problem.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/targetgroup.go:376

		}

		request := &elbv2.CreateTargetGroupInput{
			Name:                       &createTargetGroupName,
			Port:                       e.Port,
			Protocol:                   e.Protocol,
			VpcId:                      e.VPC.ID,
			HealthCheckIntervalSeconds: e.Interval,
			HealthyThresholdCount:      e.HealthyThreshold,
			UnhealthyThresholdCount:    e.UnhealthyThreshold,
			HealthCheckProtocol:        e.HealthCheckProtocol,
			HealthCheckPath:            e.HealthCheckPath,
			Tags:                       awsup.ELBv2Tags(tags),
		}

		klog.V(2).Infof("Creating Target Group for NLB")
		response, err := t.Cloud.ELBV2().CreateTargetGroup(ctx, request)
		if err != nil {
			return fmt.Errorf("creating NLB target group: %w", err)
		}

		if err := ModifyTargetGroupAttributes(ctx, t.Cloud, response.TargetGroups[0].TargetGroupArn, e.Attributes); err != nil {
			return err
		}

		// Avoid spurious changes
		e.ARN = response.TargetGroups[0].TargetGroupArn

		// TODO: Set revision or info?
	} else {
		if a.ARN != nil {
			if err := t.AddELBV2Tags(fi.ValueOf(a.ARN), e.Tags); err != nil {
				return err
			}
			if err := ModifyTargetGroupAttributes(ctx, t.Cloud, a.ARN, e.Attributes); err != nil {
				return err
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %w cause for the exact AWS error code and address it (InvalidPermissions, throttling, etc.)
2. Verify IAM role includes elasticloadbalancing:CreateTargetGroup and related elbv2 permissions
3. Confirm the VPC/subnets referenced by the NLB/target group still exist and match the cluster spec
4. Re-run the apply after transient AWS errors (throttling/5xx)

// pre-check IAM and quota before apply
// aws iam simulate-principal-policy --policy-source-arn <role> --action-names elasticloadbalancing:CreateTargetGroup
// aws elbv2 describe-account-limits

if err := applyCluster(); err != nil {
  if strings.Contains(err.Error(), "creating NLB target group") {
    var terr smithy.APIError
    if errors.As(err, &terr) {
      switch terr.ErrorCode() {
      case "ThrottlingException": time.Sleep(backoff) // then retry
      case "AccessDenied": fixIAM()
      default: log.Printf("fix spec: %v", terr.ErrorMessage())
      }
    }
  }
}

When it happens

Trigger: `kops update cluster` rendering a new NLB target group where CreateTargetGroup returns an error: invalid subnet/VPC, unsupported protocol, invalid port range, missing elasticloadbalancing:CreateTargetGroup permission, or API throttling.

Common situations: IAM policy lacking elbv2 write permissions; VPC/subnet deleted or misconfigured in the spec; protocol (TCP/UDP/HTTP) mismatch with NLB type; AWS API throttling during large applies.

Related errors

• listing ELB TargetGroups: %w
• error deleting TargetGroup %q: %v
• target group not yet created (arn not set)
• modifying NLB target group health check: %w
• error deleting ELB TargetGroup %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c4e1602306a5a0a8. Report an issue: GitHub.