kubernetes/kops · error

error listing Eventbridge rules: %v

Error message

error listing Eventbridge rules: %v

What it means

ListEventBridgeRules in pkg/resources/aws/eventbridge.go enumerates EventBridge rules whose names start with the cluster-name prefix (used by `kops delete cluster` to find cluster-owned rules). This error wraps any failure returned by the EventBridge ListRules API call. It means the lookup of cluster rules could not be completed, so cluster deletion cannot inventory EventBridge resources.

Source

Thrown at pkg/resources/aws/eventbridge.go:98

	return nil
}

func ListEventBridgeRules(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing EventBridge rules")
	clusterNamePrefix := awsup.GetClusterName40(clusterName)

	// rule names start with the cluster name so that we can search for them
	request := &eventbridge.ListRulesInput{
		EventBusName: nil,
		Limit:        nil,
		NamePrefix:   aws.String(clusterNamePrefix),
	}
	response, err := c.EventBridge().ListRules(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing Eventbridge rules: %v", err)
	}
	if response == nil || len(response.Rules) == 0 {
		return nil, nil
	}

	var resourceTrackers []*resources.Resource

	for _, rule := range response.Rules {
		resourceTracker := &resources.Resource{
			Name:    *rule.Name,
			ID:      *rule.Name,
			Type:    TypeEventBridgeRule,
			Deleter: EventBridgeRuleDeleter,
			Dumper:  DumpEventBridgeRule,
			Obj:     rule,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify AWS credentials and region used to build the AWSCloud client (aws sts get-caller-identity in the target region).
2. Check IAM policy grants events:ListRules on the account/default event bus.
3. Retry on throttling; add backoff or reduce concurrent describe calls in the same deletion run.
4. Ensure the cluster name (and thus GetClusterName40 prefix) is a valid EventBridge rule-name prefix (<=64 chars, valid pattern).

Example fix

// before
response, err := c.EventBridge().ListRules(ctx, request)
// after
response, err := c.EventBridge().ListRules(ctx, request)
if err != nil {
    var terr *types.ThrottlingException
    if errors.As(err, &terr) {
        // retry with backoff
    }
    return nil, fmt.Errorf("error listing Eventbridge rules: %w", err)
}

// Go: preflight before deletion run
sess, err := config.LoadDefaultConfig(ctx)
if err != nil { return fmt.Errorf("no AWS config: %w", err) }
if _, err := sts.NewFromConfig(sess).GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}); err != nil {
    return fmt.Errorf("invalid AWS credentials: %w", err)
}
if len(clusterNamePrefix) > 64 {
    return fmt.Errorf("cluster prefix %q too long for EventBridge rule name", clusterNamePrefix)
}

func isEventBridgeListErr(err error) (retryable bool, ok bool) {
    if err == nil { return false, false }
    var rerr *types.ThrottlingException
    if errors.As(err, &rerr) { return true, true }
    var aerr *types.AccessDeniedException
    if errors.As(err, &aerr) { return false, true }
    return false, true
}

rules, err := ListEventBridgeRules(cloud, vpcID, clusterName)
if err != nil {
    klog.Warningf("EventBridge listing failed, continuing deletion: %v", err)
    rules = nil // fallback: proceed without EventBridge cleanup
}

When it happens

Trigger: Any non-nil error from c.EventBridge().ListRules with EventBusName=nil and NamePrefix=<clusterNamePrefix>: missing/invalid AWS credentials, wrong region on the cloud client, throttling (ThrottlingException), AccessDeniedException from restrictive IAM, invalid NamePrefix (>64 chars) producing ValidationException, or network/API outages.

Common situations: Expired or absent AWS session during `kops delete cluster`; IAM policy without events:ListRules; misconfigured KOPS_REGION/AWS_REGION; the 40-char cluster prefix (GetClusterName40) exceeding EventBridge rule-name limits; transient throttling on accounts with many rules.

Related errors

• listing targets for EventBridge rule %q: %w
• removing targets for EventBridge rule %q: %w
• deleting EventBridge rule %q: %w
• error listing EventBridge rules: %v
• found multiple EventBridge rules with the same name

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d383fc21440ccfe1. Report an issue: GitHub.