kubernetes/kops · error

error updating LaunchTemplate tags: %v

Error message

error updating LaunchTemplate tags: %v

What it means

This error wraps a failure from c.UpdateTags() while applying tag changes to an existing EC2 Launch Template during RenderAWS. It is thrown when the task diff detects a Tags change and the CreateTags API call on the launch template fails. The launch template itself exists; only the tag mutation failed, so the error is a partial-update failure for the resource.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/launchtemplate_target_api.go:193

			LaunchTemplateName: t.Name,
			LaunchTemplateData: data,
		}
		if version, err := c.Cloud.EC2().CreateLaunchTemplateVersion(ctx, input); err != nil {
			return fmt.Errorf("error creating LaunchTemplateVersion: %v", err)
		} else {
			newDefault := strconv.FormatInt(*version.LaunchTemplateVersion.VersionNumber, 10)
			input := &ec2.ModifyLaunchTemplateInput{
				DefaultVersion:   &newDefault,
				LaunchTemplateId: version.LaunchTemplateVersion.LaunchTemplateId,
			}
			if _, err := c.Cloud.EC2().ModifyLaunchTemplate(ctx, input); err != nil {
				return fmt.Errorf("error updating launch template version: %w", err)
			}
		}
		if changes.Tags != nil {
			err = c.UpdateTags(fi.ValueOf(a.ID), e.Tags)
			if err != nil {
				return fmt.Errorf("error updating LaunchTemplate tags: %v", err)
			}
		}
		e.ID = a.ID

	}

	return nil
}

// Find is responsible for finding the launch template for us
func (t *LaunchTemplate) Find(c *fi.CloudupContext) (*LaunchTemplate, error) {
	cloud := awsup.GetCloud(c)

	// @step: get the latest launch template version
	lt, err := t.findLatestLaunchTemplateVersion(c)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped %v message for the exact EC2 error code (InvalidParameterValue, Throttling, UnauthorizedOperation)
2. Verify tag keys/values meet EC2 constraints (1-128 chars key, 1-256 chars value, allowed characters, no 'aws:' prefix)
3. Ensure the IAM role of the controller has ec2:CreateTags permission on launch templates
4. Retry on throttling; reduce concurrent API calls or add backoff
5. Confirm the launch template still exists before updating (it may have been deleted out-of-band)

Example fix

// before
c.tags["kops.k8s.io/cluster"] = "" // empty tag value causing InvalidParameterValue
// after
c.tags["kops.k8s.io/cluster"] = clusterName // valid non-empty value

for k, v := range desiredTags {
  if k == "" || len(k) > 128 || len(v) > 256 { return fmt.Errorf("invalid tag %q", k) }
  if strings.HasPrefix(strings.ToLower(k), "aws:") { return fmt.Errorf("reserved tag key %q", k) }
}
if len(desiredTags) > 50 { return errors.New("too many tags (max 50)") }

err := c.UpdateTags(id, tags)
if err != nil {
  var awsErr smithy.APIError
  if errors.As(err, &awsErr) && awsErr.ErrorCode() == "ThrottlingException" {
    // back off and retry
  }
  return fmt.Errorf("error updating LaunchTemplate tags: %w", err)
}

When it happens

Trigger: RenderAWS finds changes.Tags != nil and calls UpdateTags on the launch template ID; the underlying ec2.CreateTags call fails due to invalid tag keys/values, too many tags (max 50), invalid characters, throttling, or the template being deleted concurrently.

Common situations: Cluster spec tags containing characters EC2 rejects (e.g. 'aws:' prefixed reserved keys on some resources, empty keys), tag limits exceeded after adding many cluster tags, AWS API throttling on large clusters, IAM policy missing ec2:CreateTags permission.

Related errors

• timed out waiting for volume to detach
• error building cloud tags: %v
• error listing AutoScaling LaunchTemplates: %v
• error deleting ec2 LaunchTemplate %q: %v
• found multiple Volumes with name: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ecd84dbac90a27ec. Report an issue: GitHub.