kubernetes/kops · error

error listing tags

Error message

error listing tags: %v

What it means

findNatGateway (the default discovery path when no ID is set) calls ec2:DescribeTags with filters (e.g. tag kubernetes.io/cluster/<name>, resource-type natgateway) to locate the cluster's NAT gateway, and wraps any DescribeTags error with this message. Discovery fails so the task cannot compute actual state.

Solutions

1. Check the wrapped error for the exact AWS code
2. Grant ec2:DescribeTags to the kOps IAM role
3. Retry on throttling errors
4. Validate filters/region configuration if InvalidFilter errors appear

// ensure permission & filters before discovery
_, err := cloud.EC2().DescribeTags(ctx, &ec2.DescribeTagsInput{Filters: filters, MaxResults: aws.Int32(5)})
if err != nil { /* surface permission/region problem early */ }

response, err := cloud.EC2().DescribeTags(ctx, request)
if err != nil {
  var re *awshttp.ResponseError
  if errors.As(err, &re) && isThrottling(re) { backoff(); continue }
  return nil, fmt.Errorf("error listing tags: %w", err)
}

When it happens

Trigger: DescribeTags returns an error: AccessDenied on ec2:DescribeTags, API throttling, invalid filter ARN/values, or transient network failure.

Common situations: IAM policy lacking ec2:DescribeTags, throttling on clusters with many tagged resources, filter mismatches after cluster rename (though those yield empty results, not this error).

Related errors

• Could not find ' ' tag from route table
• error adding AWS Tags to EBS Volume
• error adding tags to resource
• error deleting ngw
• error deleting tags on

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/34fd25887dfa31cc. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:165

	// Find via tag on subnet
	// TODO: Obsolete - we can get from the route table instead
	if id == nil && e.Subnet != nil {
		var filters []ec2types.Filter
		filters = append(filters, awsup.NewEC2Filter("key", "AssociatedNatgateway"))
		if e.Subnet.ID == nil {
			klog.V(2).Infof("Unable to find subnet, bypassing Find() for NatGateway")
			return nil, nil
		}
		filters = append(filters, awsup.NewEC2Filter("resource-id", *e.Subnet.ID))

		request := &ec2.DescribeTagsInput{
			Filters: filters,
		}

		response, err := cloud.EC2().DescribeTags(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing tags: %v", err)
		}

		if response == nil || len(response.Tags) == 0 {
			return nil, nil
		}

		if len(response.Tags) != 1 {
			return nil, fmt.Errorf("found multiple tags for: %v", e)
		}
		t := response.Tags[0]
		id = t.Value
		klog.V(2).Infof("Found NatGateway via subnet tag: %v", *id)
	}

	if id != nil {
		return findNatGatewayById(ctx, cloud, fi.ValueOf(id))
	}

View on GitHub (pinned to 4c8573c808)