kubernetes/kops · error

error adding tags to ELBV2 %q: %v

Error message

error adding tags to ELBV2 %q: %v

What it means

AWSAPITarget.AddELBV2Tags computes the set of missing tags and calls Cloud.CreateELBV2Tags; any SDK failure writing those tags is wrapped with this message including the resource ARN. Thrown only when at least one tag is missing.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_apitarget.go:87

	actual, err := t.Cloud.GetELBV2Tags(ResourceArn)
	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	missing := map[string]string{}
	for k, v := range expected {
		actualValue, found := actual[k]
		if found && actualValue == v {
			continue
		}
		missing[k] = v
	}

	if len(missing) != 0 {
		klog.V(4).Infof("adding tags to %q: %v", ResourceArn, missing)
		err := t.Cloud.CreateELBV2Tags(ResourceArn, missing)
		if err != nil {
			return fmt.Errorf("error adding tags to ELBV2 %q: %v", ResourceArn, err)
		}
	}

	return nil
}

func (t *AWSAPITarget) RemoveELBV2Tags(ResourceArn string, expected map[string]string) error {
	actual, err := t.Cloud.GetELBV2Tags(ResourceArn)
	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	extra := map[string]string{}
	for k, v := range actual {
		expectedValue, found := expected[k]
		if found && expectedValue == v {
			continue
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant elasticloadbalancing:AddTags to the kOps IAM role
2. Validate tag values (≤256 chars, no invalid characters) in the cluster spec (cluster.spec.tags / extraTags)
3. Re-run kops update cluster — idempotent retry after throttling or concurrent deletion
4. Check the wrapped error code for the precise cause

Example fix

// before
err := t.Cloud.CreateELBV2Tags(ResourceArn, missing)
if err != nil {
	return fmt.Errorf("error adding tags to ELBV2 %q: %v", ResourceArn, err)
}
// after: retry throttling
if code := awsup.AWSErrorCode(err); code == "Throttling" {
	return fi.NewTryAgainLaterError("ELBV2 tags throttled").WithError(err)
}

for k, v := range expectedTags {
	if len(v) > 256 { return fmt.Errorf("tag %s value too long", k) }
}
if !iamAllows("elasticloadbalancing:AddTags") { return errors.New("IAM policy missing elasticloadbalancing:AddTags") }

err := target.AddELBV2Tags(arn, expectedTags)
if err != nil {
	if strings.Contains(err.Error(), "Throttling") { time.Sleep(backoff); return retry() }
	return err
}

When it happens

Trigger: After diffing expected vs actual ELBV2 tags, CreateELBV2Tags(ResourceArn, missing) fails (throttling, permission, resource deleted concurrently, invalid tag value).

Common situations: IAM missing elasticloadbalancing:AddTags; tag values exceed AWS limits (256 chars) or use forbidden characters; ALB removed by another process; heavy automation causing DescribeTags/AddTags throttling.

Related errors

• Found NLB %q linked to DNS name %q, but it did not have a Na
• unexpected error fetching tags for resource: %v
• error removing tags from ELBV2 %q: %v
• listing ELB tags: %w
• listing ELB TargetGroup tags: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bdbc99f073a1dfea. Report an issue: GitHub.