kubernetes/kops · error

error attaching LoadBalancers

Error message

error attaching LoadBalancers: %v

What it means

AttachLoadBalancers failed while attaching classic ELBs to the ASG; the ASG was updated but the load balancer attachment is incomplete. The wrapped error is the raw AWS autoscaling API error.

Solutions

1. Verify the load balancer name in the instance group spec exists in the same region/VPC as the ASG subnets.
2. Ensure kops created the ELB first (run full `kops update cluster --yes`, not a partial apply).
3. Check IAM permissions include autoscaling:AttachLoadBalancers and ELB read access.
4. Retry after backoff if throttled.

Example fix

// before: wrong region ELB name
loadBalancer:
  loadBalancerName: my-elb-eu-west-1
// after: kops-managed attachment
loadBalancer:
  targetGroupArn: <arn-in-same-vpc>

// verify ELB exists in the ASG region/VPC before attach
out, err := elbSvc.DescribeLoadBalancers(&elb.DescribeLoadBalancersInput{LoadBalancerNames: []string{lbName}})
if err != nil || len(out.LoadBalancerDescriptions) == 0 {
  return fmt.Errorf("ELB %s missing or wrong region", lbName)
}

if _, err := svc.AttachLoadBalancers(ctx, req); err != nil {
  var ae smithy.APIError
  if errors.As(err, &ae) && ae.ErrorCode() == "ValidationError" {
    return fmt.Errorf("check ELB name/VPC in instanceGroup spec: %w", err)
  }
  return retry(err)
}

When it happens

Trigger: During ASG update, attachLBRequest is built (a classic load balancer added to the ASG spec) and Autoscaling().AttachLoadBalancers fails: ELB not found or in wrong region/VPC, ELB deleted between check and use, throttling, or missing autoscaling:AttachLoadBalancers permission.

Common situations: Adding a loadBalancer attachment to an instance group while the ELB name is misspelled; ELB lives in a different VPC than the ASG subnets; cross-account ELB not shared; throttling during big applies.

Related errors

• error detatching LoadBalancers
• error deleting old AutoscalingGroup tags
• error updating AutoscalingGroup tags
• error updating AutoscalingGroup
• failed to attach target groups

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/80d69bb79c888b43. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awstasks/autoscalinggroup.go:682

		if deleteTagsRequest != nil && len(deleteTagsRequest.Tags) > 0 {
			if _, err := t.Cloud.Autoscaling().DeleteTags(ctx, deleteTagsRequest); err != nil {
				return fmt.Errorf("error deleting old AutoscalingGroup tags: %v", err)
			}
		}
		if updateTagsRequest != nil {
			if _, err := t.Cloud.Autoscaling().CreateOrUpdateTags(ctx, updateTagsRequest); err != nil {
				return fmt.Errorf("error updating AutoscalingGroup tags: %v", err)
			}
		}

		if detachLBRequest != nil {
			if _, err := t.Cloud.Autoscaling().DetachLoadBalancers(ctx, detachLBRequest); err != nil {
				return fmt.Errorf("error detatching LoadBalancers: %v", err)
			}
		}
		if attachLBRequest != nil {
			if _, err := t.Cloud.Autoscaling().AttachLoadBalancers(ctx, attachLBRequest); err != nil {
				return fmt.Errorf("error attaching LoadBalancers: %v", err)
			}
		}
		if len(attachTGRequests) > 0 {
			for _, attachTGRequest := range attachTGRequests {
				if _, err := t.Cloud.Autoscaling().AttachLoadBalancerTargetGroups(ctx, attachTGRequest); err != nil {
					return fmt.Errorf("failed to attach target groups: %v", err)
				}
			}
		}
	}

	return nil
}

// UseMixedInstancesPolicy checks if we should add a mixed instances policy to the asg
func (e *AutoscalingGroup) UseMixedInstancesPolicy() bool {
	if e.LaunchTemplate == nil {
		return false

View on GitHub (pinned to 4c8573c808)