kubernetes/kops · error

deleting EventBridge rule %q: %w

Error message

deleting EventBridge rule %q: %w

What it means

kOps wraps the AWS SDK error from eventbridge DeleteRule, the final step of DeleteEventBridgeRule after targets were removed. At this point the rule should be deletable, so failures here are permission, throttling, or concurrent-modification issues rather than dependency violations. Uses %w so callers can match on the underlying smithy error.

Source

Thrown at pkg/resources/aws/eventbridge.go:78

			ids = append(ids, aws.ToString(target.Id))
		}
		klog.V(2).Infof("Removing EventBridge Targets for rule %q", ruleName)
		_, err = c.EventBridge().RemoveTargets(ctx, &eventbridge.RemoveTargetsInput{
			Ids:  ids,
			Rule: aws.String(ruleName),
		})
		if err != nil {
			return fmt.Errorf("removing targets for EventBridge rule %q: %w", ruleName, err)
		}
	}

	klog.V(2).Infof("Deleting EventBridge rule %q", ruleName)
	request := &eventbridge.DeleteRuleInput{
		Name: aws.String(ruleName),
	}
	_, err = c.EventBridge().DeleteRule(ctx, request)
	if err != nil {
		return fmt.Errorf("deleting EventBridge rule %q: %w", ruleName, err)
	}
	return nil
}

func ListEventBridgeRules(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing EventBridge rules")
	clusterNamePrefix := awsup.GetClusterName40(clusterName)

	// rule names start with the cluster name so that we can search for them
	request := &eventbridge.ListRulesInput{
		EventBusName: nil,
		Limit:        nil,
		NamePrefix:   aws.String(clusterNamePrefix),
	}
	response, err := c.EventBridge().ListRules(ctx, request)

View on GitHub (pinned to 4c8573c808)

Solutions

1. If ResourceNotFound, the rule is already gone — re-run the delete; it will succeed or skip
2. Add events:DeleteRule to the caller's policy if AccessDenied
3. Retry after backoff for ConcurrentModificationException/LimitExceededException
4. Ensure only one deletion process runs per cluster

// preflight: rule must exist and have no targets
out, err := eventsClient.ListTargetsByRule(ctx, &eventbridge.ListTargetsByRuleInput{Rule: aws.String(ruleName)})
if err == nil && len(out.Targets) > 0 { return fmt.Errorf("rule %s still has targets", ruleName) }

func isAlreadyDeleted(err error) bool {
  var rnf *types.ResourceNotFoundException
  return errors.As(err, &rnf)
}

err := DeleteEventBridgeRule(ctx, cloud, ruleName)
var rnf *types.ResourceNotFoundException
if errors.As(err, &rnf) { return nil /* rule already gone */ }
if err != nil { return err }

When it happens

Trigger: DeleteRule fails: AccessDenied on events:DeleteRule, ResourceNotFoundException (rule deleted concurrently after target removal), ConcurrentModificationException, or LimitExceededException throttling.

Common situations: Concurrent operators deleting the same cluster; IAM policies that allow listing/removing targets but not DeleteRule; org-level SCPs denying events:DeleteRule.

Related errors

• listing targets for EventBridge rule %q: %w
• removing targets for EventBridge rule %q: %w
• error terminating instances: %v
• error deleting KeyPair %q: %v
• error deleting EgressOnlyInternetGateway %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/50255d48574252d9. Report an issue: GitHub.