kubernetes/kops · error

error configuring NLB attributes for NLB %q: %v

Error message

error configuring NLB attributes for NLB %q: %v

What it means

modifyLoadBalancerAttributes calls ELBV2 ModifyLoadBalancerAttributes for a Network Load Balancer and wraps any API error with this message, including the NLB ARN. It means kOps could not apply desired attributes (e.g. access logs, delete protection, cross-zone load balancing) to the NLB.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancer_attributes.go:122

			Value: e.AccessLog.S3BucketName,
		}
		attributes = append(attributes, attr)
	}
	if e.AccessLog != nil && e.AccessLog.S3BucketPrefix != nil {
		attr := elbv2types.LoadBalancerAttribute{
			Key:   aws.String("access_logs.s3.prefix"),
			Value: e.AccessLog.S3BucketPrefix,
		}
		attributes = append(attributes, attr)
	}

	request.Attributes = attributes

	klog.V(2).Infof("Configuring NLB attributes for NLB %q", loadBalancerArn)

	response, err := t.Cloud.ELBV2().ModifyLoadBalancerAttributes(ctx, request)
	if err != nil {
		return fmt.Errorf("error configuring NLB attributes for NLB %q: %v", loadBalancerArn, err)
	}

	klog.V(4).Infof("modified NLB attributes for NLB %q, response %+v", loadBalancerArn, response)

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped AWS error for the rejected attribute
2. If delete protection is on, disable deletion_protection.enabled before deleting/modifying
3. Verify access-logs S3 bucket exists, is in the same region, and has the ELB log-delivery bucket policy
4. Check attribute names/values against current aws-sdk-go-v2 elbv2 API

Example fix

// before: delete protection blocks teardown
attributes["load_balancing.cross_zone.enabled"] = "true"
attributes["deletion_protection.enabled"] = "true"
// after: allow deletion during cluster teardown
attributes["deletion_protection.enabled"] = "false"

// verify S3 access-logs setup before enabling
if attrs["access_logs.s3.enabled"] == "true" {
  if !s3BucketHasELBDeliveryPolicy(bucket, region) { return fmt.Errorf("bucket %s lacks ELB delivery policy", bucket) }
}

response, err := t.Cloud.ELBV2().ModifyLoadBalancerAttributes(ctx, request)
if err != nil {
  if isThrottling(err) { /* retry with backoff */ }
  return fmt.Errorf("error configuring NLB attributes for NLB %q: %v", loadBalancerArn, err)
}

When it happens

Trigger: ModifyLoadBalancerAttributes rejected: invalid attribute combination, delete_protection.enabled=true while trying to delete/modify, access logs S3 bucket misconfigured or lacking permissions, unsupported attribute values, or the ARN is wrong/not found.

Common situations: Enabling access logging with a bucket in the wrong region or missing elb log delivery policy; attempting cluster teardown while deletion_protection is enabled; typo'd or deprecated attribute keys after AWS SDK upgrades.

Related errors

• error deleting V2 LoadBalancer %q: %v
• error mapping DNSName %q to LoadBalancer: %v
• Found NLB %q linked to DNS name %q, but it did not have a Na
• creating listener for NLB on port %v: %w
• looking for AWS NLB: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7a211bd7a327cb28. Report an issue: GitHub.