kubernetes/kops · error

error listing tags: %v

Error message

error listing tags: %v

What it means

findNatGateway (the default discovery path when no ID is set) calls ec2:DescribeTags with filters (e.g. tag kubernetes.io/cluster/<name>, resource-type natgateway) to locate the cluster's NAT gateway, and wraps any DescribeTags error with this message. Discovery fails so the task cannot compute actual state.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:165

	// Find via tag on subnet
	// TODO: Obsolete - we can get from the route table instead
	if id == nil && e.Subnet != nil {
		var filters []ec2types.Filter
		filters = append(filters, awsup.NewEC2Filter("key", "AssociatedNatgateway"))
		if e.Subnet.ID == nil {
			klog.V(2).Infof("Unable to find subnet, bypassing Find() for NatGateway")
			return nil, nil
		}
		filters = append(filters, awsup.NewEC2Filter("resource-id", *e.Subnet.ID))

		request := &ec2.DescribeTagsInput{
			Filters: filters,
		}

		response, err := cloud.EC2().DescribeTags(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing tags: %v", err)
		}

		if response == nil || len(response.Tags) == 0 {
			return nil, nil
		}

		if len(response.Tags) != 1 {
			return nil, fmt.Errorf("found multiple tags for: %v", e)
		}
		t := response.Tags[0]
		id = t.Value
		klog.V(2).Infof("Found NatGateway via subnet tag: %v", *id)
	}

	if id != nil {
		return findNatGatewayById(ctx, cloud, fi.ValueOf(id))
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error for the exact AWS code
2. Grant ec2:DescribeTags to the kOps IAM role
3. Retry on throttling errors
4. Validate filters/region configuration if InvalidFilter errors appear

// ensure permission & filters before discovery
_, err := cloud.EC2().DescribeTags(ctx, &ec2.DescribeTagsInput{Filters: filters, MaxResults: aws.Int32(5)})
if err != nil { /* surface permission/region problem early */ }

response, err := cloud.EC2().DescribeTags(ctx, request)
if err != nil {
  var re *awshttp.ResponseError
  if errors.As(err, &re) && isThrottling(re) { backoff(); continue }
  return nil, fmt.Errorf("error listing tags: %w", err)
}

When it happens

Trigger: DescribeTags returns an error: AccessDenied on ec2:DescribeTags, API throttling, invalid filter ARN/values, or transient network failure.

Common situations: IAM policy lacking ec2:DescribeTags, throttling on clusters with many tagged resources, filter mismatches after cluster rename (though those yield empty results, not this error).

Related errors

• error describing RouteTables: %v
• error describing NatGateways: %v
• error from DescribeRouteTables: %v
• error from DescribeNatGateways: %v
• NextToken set from DescribeNatGateways, but pagination not i

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/34fd25887dfa31cc. Report an issue: GitHub.