kubernetes/kops · error

error describing autoScalingGroups

Error message

error describing autoScalingGroups: %v

What it means

deregisterInstance() re-fetches the Auto Scaling Group via DescribeAutoScalingGroups to learn which Classic ELBs and target groups the instance must be drained from; if that AWS API call fails, this error wraps the SDK error. Without the ASG details kOps cannot determine the load balancer set, so deregistration aborts.

Solutions

1. Verify the IAM policy grants autoscaling:DescribeAutoScalingGroups
2. Check the ASG still exists (name comes from the cached CloudInstanceGroup.Raw) — if deleted, refresh cluster state and retry
3. Retry the operation; throttling errors (Throttling/RequestLimitExceeded) are transient — reduce concurrency for huge updates
4. Check AWS region configuration matches where the cluster's ASGs live

Example fix

// before: policy missing
// error describing autoScalingGroups: AccessDenied: User is not authorized to perform: autoscaling:DescribeAutoScalingGroups
// after: add to IAM policy statement
{"Effect":"Allow","Action":["autoscaling:DescribeAutoScalingGroups"],"Resource":"*"}

_, err := asgSvc.DescribeAutoScalingGroups(&autoscaling.DescribeAutoScalingGroupsInput{
	AutoScalingGroupNames: []string{asgName}})
if err != nil {
	return fmt.Errorf("precheck failed: %w", err)
}

func isThrottle(err error) bool {
	var ae smithy.APIError
	return errors.As(err, &ae) && (ae.ErrorCode() == "Throttling" || ae.ErrorCode() == "RequestLimitExceeded")
}

if err := cloud.DeregisterInstance(inst); err != nil {
	if strings.Contains(err.Error(), "error describing autoScalingGroups") {
		// retry with backoff; throttling/describe failures are usually transient
		return retryWithBackoff(3, 5*time.Second, func() error { return cloud.DeregisterInstance(inst) })
	}
	return err
}

When it happens

Trigger: deregisterInstance calls c.Autoscaling().DescribeAutoScalingGroups with the instance's ASG name and AWS returns an error: throttling (RequestLimitExceeded), AccessDenied, InvalidGroupName.NotFound, or network failure.

Common situations: IAM policy missing autoscaling:DescribeAutoScalingGroups; ASG deleted while kOps still holds a reference to it; API throttling during large rolling updates across many groups; temporary AWS API outage.

Related errors

• error creating AutoScalingGroup
• error deleting autoscaling group
• error listing ASG Lifecycle Hooks
• error listing AutoScalingGroups
• checking if bucket was public

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/967aa017559b3edd. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:522

		} else {
			return fmt.Errorf("error deleting instance %q: %v", id, err)
		}
	}

	klog.V(8).Infof("deleted aws ec2 instance %q", id)

	return nil
}

// deregisterInstance ensures that the instance is fully drained/removed from all associated loadBalancers and targetGroups before termination.
func deregisterInstance(ctx context.Context, c AWSCloud, i *cloudinstances.CloudInstance) error {
	asg := i.CloudInstanceGroup.Raw.(*autoscalingtypes.AutoScalingGroup)

	asgDetails, err := c.Autoscaling().DescribeAutoScalingGroups(ctx, &autoscaling.DescribeAutoScalingGroupsInput{
		AutoScalingGroupNames: []string{aws.ToString(asg.AutoScalingGroupName)},
	})
	if err != nil {
		return fmt.Errorf("error describing autoScalingGroups: %v", err)
	}

	if len(asgDetails.AutoScalingGroups) == 0 {
		return nil
	}

	// there will always be only one ASG in the DescribeAutoScalingGroups response.
	loadBalancerNames := asgDetails.AutoScalingGroups[0].LoadBalancerNames
	targetGroupArns := asgDetails.AutoScalingGroups[0].TargetGroupARNs

	eg, _ := errgroup.WithContext(context.Background())

	if len(loadBalancerNames) != 0 {
		eg.Go(func() error {
			return deregisterInstanceFromClassicLoadBalancer(ctx, c, loadBalancerNames, i.ID)
		})
	}

View on GitHub (pinned to 4c8573c808)