kubernetes/kops · error

error tagging instance %q: %v

Error message

error tagging instance %q: %v

What it means

During rolling update, kOps first tags the instance with the detached-instance tag (its ASG name) before detaching it; the CreateTags EC2 call failed, so the detach flow aborts with the wrapped AWS error.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:684

	if i.Status == cloudinstances.CloudInstanceStatusDetached {
		return nil
	}
	if c.spotinst != nil {
		return spotinst.DetachInstance(c.spotinst, i)
	}

	return detachInstance(ctx, c, i)
}

func detachInstance(ctx context.Context, c AWSCloud, i *cloudinstances.CloudInstance) error {
	id := i.ID
	if id == "" {
		return fmt.Errorf("id was not set on CloudInstance: %v", i)
	}

	asg := i.CloudInstanceGroup.Raw.(*autoscalingtypes.AutoScalingGroup)
	if err := c.CreateTags(id, map[string]string{tagNameDetachedInstance: *asg.AutoScalingGroupName}); err != nil {
		return fmt.Errorf("error tagging instance %q: %v", id, err)
	}

	// TODO this also deregisters the instance from any ELB attached to the ASG. Do we care?

	input := &autoscaling.DetachInstancesInput{
		AutoScalingGroupName:           aws.String(i.CloudInstanceGroup.HumanName),
		InstanceIds:                    []string{id},
		ShouldDecrementDesiredCapacity: aws.Bool(false),
	}

	if _, err := c.Autoscaling().DetachInstances(ctx, input); err != nil {
		return fmt.Errorf("error detaching instance %q: %v", id, err)
	}

	klog.V(8).Infof("detached aws ec2 instance %q", id)

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check ec2:CreateTags permissions for the credentials in use
2. Retry the rolling update for transient API errors

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:684 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf75099452637bdc. Report an issue: GitHub.