kubernetes/kops · error

error building cloud tags: %v

Error message

error building cloud tags: %v

What it means

buildLaunchTemplateTask calls CloudTagsForInstanceGroup to compute the tags applied to the launch template / instances; if that helper returns an error it is wrapped as "error building cloud tags" and the launch template task is not created.

Source

Thrown at pkg/model/awsmodel/autoscalinggroup.go:204

			rootVolumeEncryption = fi.ValueOf(ig.Spec.RootVolume.Encryption)
		}

		if fi.ValueOf(ig.Spec.RootVolume.Encryption) && ig.Spec.RootVolume.EncryptionKey != nil {
			rootVolumeKmsKey = *ig.Spec.RootVolume.EncryptionKey
		}
	}
	if rootVolumeType == "" {
		rootVolumeType = DefaultVolumeType
	}

	securityGroups, err := b.buildSecurityGroups(c, ig)
	if err != nil {
		return nil, err
	}

	tags, err := b.CloudTagsForInstanceGroup(ig)
	if err != nil {
		return nil, fmt.Errorf("error building cloud tags: %v", err)
	}

	lt := &awstasks.LaunchTemplate{
		Name:                    new(name),
		Lifecycle:               b.Lifecycle,
		CPUCredits:              new(fi.ValueOf(ig.Spec.CPUCredits)),
		HTTPPutResponseHopLimit: new(int32(1)),
		HTTPTokens:              new(ec2types.LaunchTemplateHttpTokensStateRequired),
		HTTPProtocolIPv6:        new(ec2types.LaunchTemplateInstanceMetadataProtocolIpv6Disabled),
		IAMInstanceProfile:      link,
		ImageID:                 new(ig.Spec.Image),
		InstanceMonitoring:      new(false),
		IPv6AddressCount:        new(int32(0)),
		RootVolumeIops:          new(int32(0)),
		RootVolumeSize:          new(int32(rootVolumeSize)),
		RootVolumeType:          rootVolumeType,
		RootVolumeEncryption:    new(rootVolumeEncryption),
		RootVolumeKmsKey:        new(rootVolumeKmsKey),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Look at the wrapped inner error (%v) for the exact tag that failed validation.
2. Remove or shorten custom tags in the cluster spec that violate AWS tag rules (key <=128 chars, value <=256 chars, allowed characters).
3. Avoid reserved prefixes like 'kubernetes.io' or 'k8s.io' in custom tags unless kOps sets them.
4. Rename/shorten the cluster name if generated tags exceed AWS limits.
5. Re-run `kops update cluster` after correcting the tags.

Example fix

// before (cluster spec)
cloudLabels:
  "my very/long tag key with*bad chars": "x"
// after
cloudLabels:
  "team": "platform"

# preflight custom tags against AWS limits before kops update
for k in $(kops get cluster -oyaml | yq '.spec.cloudLabels // {} | keys[]'); do
  [ ${#k} -le 128 ] || { echo "tag key too long: $k"; exit 1; }
  case "$k" in kubernetes.io/*|k8s.io/*) echo "reserved prefix: $k"; exit 1;; esac
done

When it happens

Trigger: `kops update cluster` when tag construction fails — most commonly because a tag key or value contains characters invalid for AWS resource tags or exceeds AWS tag limits (256-char value, 128-char key), or the cluster/spec supplies an unparseable tag.

Common situations: Custom tags added via cluster spec (spec.cloudTags or hooks) containing invalid characters or reserved prefixes; overly long cluster names pushing generated tag values over AWS limits; cross-account/tooling injecting malformed tags.

Related errors

• error updating LaunchTemplate tags: %v
• ErrAlreadyExists
• DIGITALOCEAN_ACCESS_TOKEN is required
• provider ID cannot be empty
• errShutdown

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/af150e2bc02fee18. Report an issue: GitHub.