kubernetes/kops · error

error listing elb Tags: %v

Error message

error listing elb Tags: %v

What it means

During DescribeELBs, the batched ELB DescribeTags call failed with an error other than LoadBalancerNotFound. kOps deliberately tolerates LoadBalancerNotFound (ELB deleted between the two calls) and falls back to per-ELB lookups; any other error aborts listing.

Source

Thrown at pkg/resources/aws/aws.go:1599

		if len(page.LoadBalancerDescriptions) == 0 {
			continue
		}
		tagRequest := &elb.DescribeTagsInput{}

		nameToELB := make(map[string]elbtypes.LoadBalancerDescription)
		for _, elb := range page.LoadBalancerDescriptions {
			name := aws.ToString(elb.LoadBalancerName)
			nameToELB[name] = elb

			tagRequest.LoadBalancerNames = append(tagRequest.LoadBalancerNames, aws.ToString(elb.LoadBalancerName))
		}

		tagResponse, err := c.ELB().DescribeTags(ctx, tagRequest)
		if err != nil {
			// An ELB may be deleted between DescribeLoadBalancers and DescribeTags;
			// in that case the batched call fails, so fall back to per-ELB lookups.
			if awsup.AWSErrorCode(err) != "LoadBalancerNotFound" {
				return nil, nil, fmt.Errorf("error listing elb Tags: %v", err)
			}
			tagResponse = &elb.DescribeTagsOutput{}
			for _, name := range tagRequest.LoadBalancerNames {
				resp, err := c.ELB().DescribeTags(ctx, &elb.DescribeTagsInput{
					LoadBalancerNames: []string{name},
				})
				if err != nil {
					if awsup.AWSErrorCode(err) == "LoadBalancerNotFound" {
						klog.V(2).Infof("ELB %q was deleted before tags could be listed", name)
						continue
					}
					return nil, nil, fmt.Errorf("error listing elb Tags: %v", err)
				}
				tagResponse.TagDescriptions = append(tagResponse.TagDescriptions, resp.TagDescriptions...)
			}
		}

		for _, t := range tagResponse.TagDescriptions {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant elasticloadbalancing:DescribeTags in the IAM policy for the credentials.
2. Retry the listing; the error is usually transient (throttling/5xx).
3. Confirm the region is correct — DescribeTags against the wrong region fails consistently.
4. If it reproduces only for specific ELBs, use the per-ELB fallback path kOps already implements to identify the culprit.
5. Check the wrapped AWS error code for the precise cause.

// Permission pre-flight
_, err := c.ELB().DescribeTags(ctx, &elb.DescribeTagsInput{LoadBalancerNames: []string{someELB}})
if err != nil && awsup.AWSErrorCode(err) == "AccessDenied" { /* fix IAM before batch work */ }

func isELBGone(err error) bool { return awsup.AWSErrorCode(err) == "LoadBalancerNotFound" }

tagResp, err := c.ELB().DescribeTags(ctx, tagRequest)
if err != nil {
    if isELBGone(err) { /* fall back to per-ELB lookups */ }
    else if isThrottle(err) { backoff-and-retry }
    else { return err }
}

When it happens

Trigger: DescribeTags on a batch of up to 20 ELB names fails with AccessDenied, ThrottlingException, or a transient 5xx that is not the tolerated LoadBalancerNotFound code.

Common situations: IAM policy allows DescribeLoadBalancers but not elasticloadbalancing:DescribeTags; throttling when many ELBs are tagged/queried concurrently; AWS transient errors mid-teardown.

Related errors

• error listing elbs: %v
• provider ID cannot be empty
• error building cloud tags: %v
• error building cloud tags: %v
• error listing EgressOnlyInternetGateway: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c6f2f55b0788b77c. Report an issue: GitHub.