kubernetes/kops · error

error mapping DNSName %q to LoadBalancer: %v

Error message

error mapping DNSName %q to LoadBalancer: %v

What it means

findDNSTargetNLB resolves a Route53 alias target back to an NLB by calling findNetworkLoadBalancerByAlias (ELBV2 DescribeLoadBalancers). When that lookup errors, kops wraps it as 'error mapping DNSName %q to LoadBalancer' (dnsname.go:144). This happens while reading current state in Find, so the DNS alias points at a load balancer kops could not resolve.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnsname.go:144

	}

	return actual, nil
}

func findDNSTarget(cloud awsup.AWSCloud, aliasTarget *route53types.AliasTarget, dnsName string, targetDNSName *string) (DNSTarget, error) {
	if NLB, err := findDNSTargetNLB(cloud, aliasTarget, dnsName, targetDNSName); err != nil {
		return nil, err
	} else if NLB != nil {
		return NLB, nil
	}

	return nil, nil
}

func findDNSTargetNLB(cloud awsup.AWSCloud, aliasTarget *route53types.AliasTarget, dnsName string, targetDNSName *string) (DNSTarget, error) {
	lb, err := findNetworkLoadBalancerByAlias(cloud, aliasTarget)
	if err != nil {
		return nil, fmt.Errorf("error mapping DNSName %q to LoadBalancer: %v", dnsName, err)
	}
	if lb != nil {
		loadBalancerName := aws.ToString(lb.LoadBalancerName) // TODO: can we keep these on object
		loadBalancerArn := aws.ToString(lb.LoadBalancerArn)   // TODO: can we keep these on object
		tagMap, err := cloud.DescribeELBV2Tags([]string{loadBalancerArn})
		if err != nil {
			return nil, err
		}
		tags := tagMap[loadBalancerArn]
		nameTag, _ := awsup.FindELBV2Tag(tags, "Name")
		if nameTag == "" {
			return nil, fmt.Errorf("Found NLB %q linked to DNS name %q, but it did not have a Name tag", loadBalancerName, fi.ValueOf(targetDNSName))
		}
		return &NetworkLoadBalancer{Name: new(nameTag)}, nil
	}
	return nil, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error from findNetworkLoadBalancerByAlias for the AWS cause
2. If AccessDenied: grant elasticloadbalancing:DescribeLoadBalancers and DescribeTags to the kops credentials
3. If throttling: retry with backoff or run kops update during lower API activity
4. Confirm the NLB and Route53 zone are in the same account/region as the kops credentials
5. If the NLB was manually deleted, remove or repair the alias record

Example fix

// before: policy without ELBV2 read
{"Action": ["ec2:*", "route53:*"]}
// after
{"Action": ["ec2:*", "route53:*", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTags"], "Effect": "Allow", "Resource": "*"}

// Confirm ELBV2 read access before resolving the alias
_, err := cloud.ELBV2().DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{PageSize: aws.Int32(1)})
if err != nil {
	return fmt.Errorf("ELBV2 describe denied/failing (check region + IAM): %w", err)
}

target, err := findDNSTarget(cloud, aliasTarget, dnsName, resourceName)
if err != nil {
	if strings.Contains(err.Error(), "AccessDenied") {
		// fix IAM: elasticloadbalancing:DescribeLoadBalancers
	} else if strings.Contains(err.Error(), "Throttling") {
		// back off and retry
	}
	return err
}

When it happens

Trigger: findNetworkLoadBalancerByAlias returns an error: ELBV2 API denied (no elasticloadbalancing:DescribeLoadBalancers), throttled, or a credential/region mismatch for the ELBV2 endpoint while matching aliasTarget DNSName/HostedZoneId against listed load balancers.

Common situations: IAM policy missing ELBV2 describe permissions; NLB deleted or moved to another account/region; API throttling when many records are resolved at once; misconfigured region in kops credentials.

Related errors

• Found NLB %q linked to DNS name %q, but it did not have a Na
• DNS ZoneID not set
• error deleting V2 LoadBalancer %q: %v
• error listing DNS ResourceRecords: %v
• error creating ResourceRecordSets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/049e027a569a92f4. Report an issue: GitHub.