kubernetes/kops · error

error attaching load balancer to new subnets: %v

Error message

error attaching load balancer to new subnets: %v

What it means

This error wraps a failure from the AWS ELBV2 SetSubnets API call while updating a Network Load Balancer's subnets during RenderAWS. kOps detected that the NLB's subnets changed, built an elbv2.SetSubnetsInput (either Subnets or SubnetMappings), and the AWS API rejected the update. The underlying AWS error is embedded via %v.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/network_load_balancer.go:599

				aIP, ok := actualSubnets[*s.Subnet.ID]
				if !ok || (fi.ValueOf(s.PrivateIPv4Address) != fi.ValueOf(aIP) && fi.ValueOf(s.AllocationID) != fi.ValueOf(aIP)) {
					hasChanges = true
				}
				awsSubnetMappings = append(awsSubnetMappings, elbv2types.SubnetMapping{
					SubnetId:           s.Subnet.ID,
					AllocationId:       s.AllocationID,
					PrivateIPv4Address: s.PrivateIPv4Address,
				})
			}

			if hasChanges {
				request := &elbv2.SetSubnetsInput{}
				request.LoadBalancerArn = aws.String(loadBalancerArn)
				request.SubnetMappings = awsSubnetMappings

				klog.V(2).Infof("Attaching Load Balancer to new subnets")
				if _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {
					return fmt.Errorf("error attaching load balancer to new subnets: %v", err)
				}
			}
		}

		if changes.SecurityGroups != nil {
			request := &elbv2.SetSecurityGroupsInput{
				LoadBalancerArn: &loadBalancerArn,
			}
			for _, sg := range e.SecurityGroups {
				request.SecurityGroups = append(request.SecurityGroups, aws.ToString(sg.ID))
			}

			klog.V(2).Infof("Updating Load Balancer Security Groups")
			if _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {
				return fmt.Errorf("Error updating security groups on Load Balancer: %v", err)
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error in %v for the exact API rejection reason
2. Ensure every new subnet's AZ is distinct and NLB-supported, and mappings include the correct EIP allocation IDs
3. Verify the NLB is active and not mid-mutation; retry after it stabilizes
4. Re-run kops update cluster after correcting the cluster spec subnets

Example fix

// before: mappings without EIPs for new subnets
request.SubnetMappings = awsSubnetMappings // missing AllocationId entries
// after: build mappings with static IPs for each new subnet
for _, s := range newSubnets {
  awsSubnetMappings = append(awsSubnetMappings, elbv2types.SubnetMapping{
    SubnetId: s.ID, AllocationId: aws.String(eipAllocations[*s.ID]),
  })
}
request.SubnetMappings = awsSubnetMappings

// validate subnets before apply
for _, s := range newSubnets {
  if err := validateSubnetInNLBSupportedAZ(s); err != nil { return err }
}
for _, m := range awsSubnetMappings {
  if m.AllocationId == nil { return fmt.Errorf("subnet mapping for %s missing EIP allocation", aws.ToString(m.SubnetId)) }
}

if _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {
  return fmt.Errorf("error attaching load balancer to new subnets: %v", err)
}
// inspect wrapped AWS error code and retry on throttling

When it happens

Trigger: Calling SetSubnets with subnets in multiple non-overlapping availability zones not supported by NLB, subnets that already host the NLB, subnet mappings missing an allocation ID/EIP for static IPs, invalid subnet IDs, or an NLB in a state that disallows subnet modification.

Common situations: Cluster spec changes that add/remove private or utility subnets on a load-balancer-backed API server; switching between Subnets and SubnetMappings incorrectly; NLBs with static EIPs where mappings don't match new subnets; cross-zone subnets in zones without NLB support (e.g. local zones).

Related errors

• Error updating security groups on Load Balancer: %v
• error deleting ELB LoadBalancer %q: %w
• error deregistering instance %q, node %q: %w
• subnet %q had unknown type %q
• unknown load balancer Type: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/88dd153721c5ac43. Report an issue: GitHub.