kubernetes/kops · error

error deleting tags on %v: %v

Error message

error deleting tags on %v: %v

What it means

kOps returns this when DeleteTags on an EC2 resource fails with a non-retryable error — any failure that is not recognized by isTagsEventualConsistencyError. It is the terminal error for tag deletion: no further retries are made.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1333

		}

		_, err := c.EC2().DeleteTags(ctx, request)
		if err != nil {
			if isTagsEventualConsistencyError(err) {
				if attempt > DeleteTagsMaxAttempts {
					return fmt.Errorf("got retryable error while deleting tags on %q, but retried too many times without success: %v", resourceID, err)
				}

				if (attempt % DeleteTagsLogInterval) == 0 {
					klog.Infof("waiting for eventual consistency while deleting tags on %q", resourceID)
				}

				klog.V(2).Infof("will retry after encountering error deleting tags on %q: %v", resourceID, err)
				time.Sleep(DeleteTagsRetryInterval)
				continue
			}

			return fmt.Errorf("error deleting tags on %v: %v", resourceID, err)
		}

		return nil
	}
}

// UpdateTags will update tags of the specified resource to match tags,
// using getTags(), createTags() and deleteTags()
func (c *awsCloudImplementation) UpdateTags(resourceID string, tags map[string]string) error {
	return updateTags(c, resourceID, tags)
}

func updateTags(c AWSCloud, resourceID string, expectedTags map[string]string) error {
	actual, err := getTags(c, resourceID)
	if err != nil {
		return err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check IAM permissions: ensure the principal has ec2:DeleteTags and ec2:CreateTags on the resource.
2. Verify the resource exists and the ID is correct via `aws ec2 describe-tags`.
3. Read the wrapped %v detail for the underlying AWS error code (AuthFailure, InvalidID.NotFound, Throttling, etc.) and address accordingly.
4. Refresh AWS credentials / check region configuration if the error is auth-related.

Example fix

// before: failing due to missing IAM action
// policy missing ec2:DeleteTags
// after: add required actions to the policy
{"Effect":"Allow","Action":["ec2:CreateTags","ec2:DeleteTags"],"Resource":"*"}

// Check IAM permissions and resource existence beforehand
_, err := ec2Client.DescribeTags(ctx, &ec2.DescribeTagsInput{Filters: []ec2types.Filter{{Name: aws.String("resource-id"), Values: []string{resourceID}}}})
// err != nil => resource not visible; skip DeleteTags

err := cloud.DeleteTags(ctx, resourceID, tagKeys)
if err != nil {
    var nf smithy.APIError
    if errors.As(err, &nf) && nf.ErrorCode() == "InvalidID.NotFound" {
        klog.V(2).Infof("resource %s already gone; skipping tag deletion", resourceID)
        return nil
    }
    return fmt.Errorf("deleting tags on %s: %w", resourceID, err)
}

When it happens

Trigger: EC2 DeleteTags called with an invalid or non-existent resourceID, missing iam:DeleteTags/CreateTags permission, or a request limit / credential error that is not classified as eventually-consistent.

Common situations: IAM policy for the kops controller lacking ec2:DeleteTags; deleting tags on a resource that was already terminated; stale credentials or expired session tokens; typo'd resource ID.

Related errors

• found multiple Volumes with name: %s
• error adding AWS Tags to EBS Volume: %v
• found multiple EgressOnlyInternetGateways matching tags
• error querying tags for ElasticIP: %v
• Unable to tag subnet %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/24f379a1656713c9. Report an issue: GitHub.