kubernetes/kops · error

error deleting load balancer listener with arn=%q: %w

Error message

error deleting load balancer listener with arn=%q: %w

What it means

When required changes exist on an existing listener, RenderAWS deletes the old listener before recreating it; if ELBV2 DeleteListener fails, this error is returned wrapping the AWS error. The message includes the (empty for new tasks) e.listenerArn rather than a.listenerArn, so the wrapped AWS error is the useful part.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go:167

	if e.NetworkLoadBalancer == nil {
		return fi.RequiredField("NetworkLoadBalancer")
	}
	loadBalancerArn := e.NetworkLoadBalancer.loadBalancerArn
	if loadBalancerArn == "" {
		return fmt.Errorf("load balancer not yet created (arn not set)")
	}

	if a != nil {
		// TODO: Can we do better here?
		klog.Warningf("deleting ELB listener %q for required changes (%+v)", a.listenerArn, changes)

		// delete the listener before recreating it
		_, err := t.Cloud.ELBV2().DeleteListener(ctx, &elbv2.DeleteListenerInput{
			ListenerArn: &a.listenerArn,
		})
		if err != nil {
			return fmt.Errorf("error deleting load balancer listener with arn=%q: %w", e.listenerArn, err)
		}
		a = nil
	}

	if a == nil {
		if e.TargetGroup == nil {
			return fi.RequiredField("TargetGroup")
		}
		targetGroupARN := fi.ValueOf(e.TargetGroup.ARN)
		if targetGroupARN == "" {
			return fmt.Errorf("target group not yet created (arn not set)")
		}
		request := &elbv2.CreateListenerInput{
			DefaultActions: []elbv2types.Action{
				{
					TargetGroupArn: aws.String(targetGroupARN),
					Type:           elbv2types.ActionTypeEnumForward,
				},

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped AWS error: ListenerNotFound means it's already gone and recreation can proceed
2. Verify IAM permissions include elasticloadbalancing:DeleteListener
3. Retry the apply after transient failures
4. Avoid concurrent kops applies against the same cluster

Example fix

// before: fatal on already-deleted
return fmt.Errorf("error deleting load balancer listener with arn=%q: %w", e.listenerArn, err)
// after: tolerate ListenerNotFound
var nf *elbv2types.ListenerNotFoundException
if errors.As(err, &nf) { a = nil } else { return fmt.Errorf(...) }

// confirm listener still exists before delete-recreate
_, err := t.Cloud.ELBV2().DescribeListeners(&elbv2.DescribeListenersInput{ListenerArns: []string{a.listenerArn}})
if isNotFound(err) { a = nil } // skip delete

_, err := t.Cloud.ELBV2().DeleteListener(ctx, &elbv2.DeleteListenerInput{ListenerArn: &a.listenerArn})
if err != nil {
  var nf *elbv2types.ListenerNotFoundException
  if !errors.As(err, &nf) {
    return fmt.Errorf("error deleting load balancer listener with arn=%q: %w", e.listenerArn, err)
  }
}

When it happens

Trigger: DeleteListener rejected: listener ARN not found (already deleted), IAM permission missing (elasticloadbalancing:DeleteListener), listener in a state that forbids deletion, throttling or network errors.

Common situations: Concurrent applies where another run already deleted the listener; IAM policy changes removing delete permissions; force-recreation of listeners after cert/protocol changes.

Related errors

• error deleting V2 LoadBalancer %q: %v
• error deleting TargetGroup %q: %v
• error deleting ELB LoadBalancer %q: %w
• error querying for NLB listeners :%v
• found multiple listeners matching %+v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3097ae3aa1ea6c78. Report an issue: GitHub.