kubernetes/kops · error

error parsing target group ARN resource: %q

Error message

error parsing target group ARN resource: %q

What it means

After the ARN parses successfully, NameForExternalTargetGroup splits the resource part on '/' and requires exactly three segments starting with 'targetgroup'. If the resource part has a different shape (or a different resource type), this error is returned. It indicates the ARN is valid but is not an ELBV2 target group ARN.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:258

	// We always compute the hash and add it, lest we trick users into assuming that we never do this
	opt := truncate.TruncateStringOptions{
		MaxLength:     32,
		AlwaysAddHash: true,
		HashLength:    6,
	}
	return truncate.TruncateString(s, opt)
}

// NameForExternalTargetGroup will attempt to calculate a meaningful name for a target group given an ARN.
func NameForExternalTargetGroup(targetGroupARN string) (string, error) {
	parsed, err := arn.Parse(targetGroupARN)
	if err != nil {
		return "", fmt.Errorf("error parsing target group ARN: %v", err)
	}
	resource := strings.Split(parsed.Resource, "/")
	if len(resource) != 3 || resource[0] != "targetgroup" {
		return "", fmt.Errorf("error parsing target group ARN resource: %q", parsed.Resource)
	}
	return resource[1], nil
}

func IsIAMNoSuchEntityException(err error) bool {
	if err == nil {
		return false
	}
	var nse *iamtypes.NoSuchEntityException
	return errors.As(err, &nse)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the ARN resource segment is 'targetgroup/<name>/<id>' with exactly three slash-separated parts.
2. Use `aws elbv2 describe-target-groups` to get the correct target group ARN rather than reusing a load balancer or listener ARN.
3. If constructing the ARN programmatically, include the target group's unique ID suffix.

Example fix

// before
NameForExternalTargetGroup("arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/my-nlb/abc")
// after
NameForExternalTargetGroup("arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-target-group/abc123")

parsed, _ := arn.Parse(tgARN)
parts := strings.Split(parsed.Resource, "/")
if len(parts) != 3 || parts[0] != "targetgroup" { return fmt.Errorf("not a targetgroup ARN: %s", parsed.Resource) }

func isTargetGroupResource(resource string) bool {
	parts := strings.Split(resource, "/")
	return len(parts) == 3 && parts[0] == "targetgroup"
}

name, err := NameForExternalTargetGroup(tgARN)
if err != nil {
	return fmt.Errorf("ARN %q is not an ELBV2 target group: %w", tgARN, err)
}

When it happens

Trigger: Passing an ARN of a load balancer (resource 'loadbalancer/...'), a listener, a classic ELB, or a hand-edited targetgroup ARN where the '/<name>/<id>' suffix is missing or has extra slashes.

Common situations: Users supply a Network Load Balancer or Application Load Balancer ARN instead of a target group ARN in the cluster spec; ARNs truncated when pasting; automation that constructs ARNs by string concatenation drops the trailing ID segment.

Related errors

• error parsing target group ARN: %v
• --region is required (when --external)
• instance id for cloud instance member cannot be empty
• unknown load balancer Type: %q
• unable to parse instance profile name from arn %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ece9630898d7510d. Report an issue: GitHub.