kubernetes/kops · error

error removing tags from ELBV2 %q: %v

Error message

error removing tags from ELBV2 %q: %v

What it means

AWSAPITarget.RemoveELBV2Tags deletes tags found on the ELBV2 resource that are not in the expected set; failures from Cloud.RemoveELBV2Tags (elasticloadbalancing:RemoveTags API) are wrapped with this message and the ARN. Only thrown when there is at least one extra tag to remove.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_apitarget.go:113

	actual, err := t.Cloud.GetELBV2Tags(ResourceArn)
	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	extra := map[string]string{}
	for k, v := range actual {
		expectedValue, found := expected[k]
		if found && expectedValue == v {
			continue
		}
		extra[k] = v
	}

	if len(extra) != 0 {
		klog.V(4).Infof("removing tags from %q: %v", ResourceArn, extra)
		err := t.Cloud.RemoveELBV2Tags(ResourceArn, extra)
		if err != nil {
			return fmt.Errorf("error removing tags from ELBV2 %q: %v", ResourceArn, err)
		}
	}

	return nil
}

func (t *AWSAPITarget) WaitForInstanceRunning(instanceID string) error {
	attempt := 0
	for {
		instance, err := t.Cloud.DescribeInstance(instanceID)
		if err != nil {
			return fmt.Errorf("error while waiting for instance to be running: %v", err)
		}

		if instance == nil {
			// TODO: Wait if we _just_ created the instance?
			return fmt.Errorf("instance not found while waiting for instance to be running")
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant elasticloadbalancing:RemoveTags to the kOps IAM role
2. Remove the conflicting tags via kops spec (don't add them manually) or exclude them from expected tags if a policy requires them
3. Re-run kops update cluster to retry after throttling or concurrent deletion
4. Check the wrapped error code for the precise API failure

Example fix

// before
err := t.Cloud.RemoveELBV2Tags(ResourceArn, extra)
if err != nil {
	return fmt.Errorf("error removing tags from ELBV2 %q: %v", ResourceArn, err)
}
// after: retry throttling
if code := awsup.AWSErrorCode(err); code == "Throttling" {
	return fi.NewTryAgainLaterError("ELBV2 tag removal throttled").WithError(err)
}

if !iamAllows("elasticloadbalancing:RemoveTags") { return errors.New("IAM policy missing elasticloadbalancing:RemoveTags") }
// confirm extra tags actually exist and are safe to remove
out, _ := elbv2.DescribeTags(&elbv2.DescribeTagsInput{ResourceArns: []string{arn}})
for _, td := range out.TagDescriptions { for k := range td.Tags { _ = k } }

err := target.RemoveELBV2Tags(arn, expectedTags)
if err != nil {
	if strings.Contains(err.Error(), "Throttling") { time.Sleep(backoff); return retry() }
	return err
}

When it happens

Trigger: After diffing, RemoveELBV2Tags(ResourceArn, extra) fails — permissions, throttling, resource deleted concurrently, or invalid TagKey list.

Common situations: IAM missing elasticloadbalancing:RemoveTags; tags were added by external tooling (e.g. cost tagging policies) and kOps fights over them; resource deleted between fetch and remove.

Related errors

• Found NLB %q linked to DNS name %q, but it did not have a Na
• unexpected error fetching tags for resource: %v
• error adding tags to ELBV2 %q: %v
• listing ELB tags: %w
• listing ELB TargetGroup tags: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bf69f91ddbbd2c3a. Report an issue: GitHub.