kubernetes/kops · error

error querying tags for ElasticIP: %v

Error message

error querying tags for ElasticIP: %v

What it means

After resolving the address, find() calls EC2 DescribeTags filtered by resource-id = allocationId to read the EIP's tags for diffing. If DescribeTags errors, it is wrapped as 'error querying tags for ElasticIP: %v'. The address itself was found; only the tag-read step failed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/elastic_ip.go:164

		a := response.Addresses[0]
		actual := &ElasticIP{
			ID:       a.AllocationId,
			PublicIP: a.PublicIp,
		}
		actual.TagOnSubnet = e.TagOnSubnet
		actual.AssociatedNatGatewayRouteTable = e.AssociatedNatGatewayRouteTable

		{
			tags, err := cloud.EC2().DescribeTags(ctx, &ec2.DescribeTagsInput{
				Filters: []ec2types.Filter{
					{
						Name:   aws.String("resource-id"),
						Values: []string{aws.ToString(a.AllocationId)},
					},
				},
			})
			if err != nil {
				return nil, fmt.Errorf("error querying tags for ElasticIP: %v", err)
			}
			var ec2Tags []ec2types.Tag
			for _, t := range tags.Tags {
				ec2Tags = append(ec2Tags, ec2types.Tag{
					Key:   t.Key,
					Value: t.Value,
				})
			}
			actual.Tags = intersectTags(ec2Tags, e.Tags)
		}

		// ElasticIP don't have a Name (no tags), so we set the name to avoid spurious changes
		actual.Name = e.Name

		e.ID = actual.ID

		// Avoid spurious changes
		actual.Lifecycle = e.Lifecycle

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add ec2:DescribeTags to the IAM policy used by kops and re-run kops update cluster
2. Retry; if throttling, back off / request an EC2 API rate-limit increase
3. Verify the allocation ID is a valid eipalloc-* string (an invalid filter value causes a filter-limit/mismatch error)
4. Check AWS health dashboard for EC2 API issues in the region

Example fix

// before: policy missing tag read
{"Effect":"Deny"} // ec2:DescribeTags absent
// after
{"Effect":"Allow","Action":["ec2:DescribeTags"],"Resource":"*"}

// ensure IAM permissions before running
actions := []string{"ec2:DescribeTags"}
// simulate with iam-simulator or aws iam simulate-principal-policy

var ae smithy.APIError
if errors.As(err, &ae) {
    switch ae.ErrorCode() {
    case "ThrottlingException": // exponential backoff retry
    case "AccessDenied": // fix IAM policy
    }
}

When it happens

Trigger: ec2.DescribeTags fails for the EIP's allocation ID: throttling (DescribeTags is a high-volume API), IAM policy denying ec2:DescribeTags, transient AWS API/network errors, or a malformed allocation ID string used as the resource-id filter.

Common situations: Strictly scoped IAM policies (kops least-privilege docs omit ec2:DescribeTags); large clusters where DescribeTags throttles; temporary AWS API outages during `kops update cluster`.

Related errors

• describing instance for arn %q
• error terminating instances: %v
• error describing instances: %v
• error describing addresses: %v
• error describing volumes: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c4eb5a0b04523666. Report an issue: GitHub.