kubernetes/kops · error

error adding tags to resource %q: %v

Error message

error adding tags to resource %q: %v

What it means

addAWSTags computed the set of missing tags but the subsequent CreateTags call failed, so the tags listed in the preceding V(4) log line were not applied to resource %q.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1407

	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	missing := map[string]string{}
	for k, v := range expected {
		actualValue, found := actual[k]
		if found && actualValue == v {
			continue
		}
		missing[k] = v
	}

	if len(missing) != 0 {
		klog.V(4).Infof("adding tags to %q: %v", id, missing)

		err := c.CreateTags(id, missing)
		if err != nil {
			return fmt.Errorf("error adding tags to resource %q: %v", id, err)
		}
	}

	return nil
}

func (c *awsCloudImplementation) RemoveELBV2Tags(ResourceArn string, tags map[string]string) error {
	return removeELBV2Tags(c, ResourceArn, tags)
}

func removeELBV2Tags(c AWSCloud, ResourceArn string, tags map[string]string) error {
	ctx := context.TODO()
	if len(tags) == 0 {
		return nil
	}

	elbTagKeysOnly := []string{}
	for k := range tags {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error code and fix the offending tag key/value (allowed chars, length limits, max 50 tags).
2. Ensure the IAM policy grants ec2:CreateTags.
3. Reduce number of custom tags or remove unused ones.
4. Retry if the error was throttling (Transient/ThrottlingException).

Example fix

// before: invalid characters in tag value
clusterName: "my_cluster@prod" // rejected by CreateTags
// after: use DNS/AWS-safe characters
clusterName: "my-cluster-prod"

// Pre-validate tags against AWS constraints before CreateTags
func validTags(tags map[string]string) bool {
    if len(tags) > 50 { return false }
    for k, v := range tags {
        if k == "" || len(k) > 128 || len(v) > 256 { return false }
    }
    return true
}

err := c.CreateTags(ctx, id, missing)
if err != nil {
    var ae smithy.APIError
    if errors.As(err, &ae) && ae.ErrorCode() == "TagLimitExceeded" {
        return fmt.Errorf("resource %s at tag limit; remove unused tags", id)
    }
    return fmt.Errorf("adding tags to %s: %w", id, err)
}

When it happens

Trigger: CreateTags called with tags that violate AWS constraints (invalid characters, >50 tags, empty key, key/value too long), missing ec2:CreateTags permission, or throttling.

Common situations: Cluster name or tag values containing characters AWS rejects; very large clusters exceeding the 50-tag limit per resource; IAM role without tag permissions; TagLimitExceeded on legacy resources.

Related errors

• found multiple Volumes with name: %s
• error adding AWS Tags to EBS Volume: %v
• found multiple EgressOnlyInternetGateways matching tags
• error querying tags for ElasticIP: %v
• Unable to tag subnet %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/72692988e38dd16a. Report an issue: GitHub.