kubernetes/kops · error

Error updating security groups on Load Balancer: %v

Error message

Error updating security groups on Load Balancer: %v

What it means

This error wraps a failure from the ELBV2 SetSecurityGroups API when updating the security groups attached to a Network Load Balancer during RenderAWS. kOps collected e.SecurityGroups IDs into a SetSecurityGroupsInput and the AWS API rejected the call. The underlying AWS error string is included in the message.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/network_load_balancer.go:614

				klog.V(2).Infof("Attaching Load Balancer to new subnets")
				if _, err := t.Cloud.ELBV2().SetSubnets(ctx, request); err != nil {
					return fmt.Errorf("error attaching load balancer to new subnets: %v", err)
				}
			}
		}

		if changes.SecurityGroups != nil {
			request := &elbv2.SetSecurityGroupsInput{
				LoadBalancerArn: &loadBalancerArn,
			}
			for _, sg := range e.SecurityGroups {
				request.SecurityGroups = append(request.SecurityGroups, aws.ToString(sg.ID))
			}

			klog.V(2).Infof("Updating Load Balancer Security Groups")
			if _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {
				return fmt.Errorf("Error updating security groups on Load Balancer: %v", err)
			}
		}

		if err := t.AddELBV2Tags(loadBalancerArn, tags); err != nil {
			return err
		}

		if err := t.RemoveELBV2Tags(loadBalancerArn, tags); err != nil {
			return err
		}
	}

	if err := e.modifyLoadBalancerAttributes(t, a, e, changes, loadBalancerArn); err != nil {
		klog.Infof("error modifying NLB attributes: %v", err)
		return err
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error for the offending security group ID
2. Verify all SG IDs exist and belong to the NLB's VPC (kops get instancegroups / aws ec2 describe-security-groups)
3. Reconcile cluster spec so e.SecurityGroups references valid SGs, then re-run kops update cluster
4. Recreate missing security groups or remove them from the cluster spec

Example fix

// before: stale SG id in spec
e.SecurityGroups = []*awstasks.SecurityGroup{{ID: aws.String("sg-deleted123")}}
// after: reference the task so kOps resolves/recreates it
e.SecurityGroups = []*awstasks.SecurityGroup{{Name: aws.String(sgName), VPC: vpcTask}}

for _, sg := range e.SecurityGroups {
  out, err := cloud.EC2().DescribeSecurityGroups(&ec2.DescribeSecurityGroupsInput{GroupIds: []string{*sg.ID}})
  if err != nil || len(out.SecurityGroups) == 0 { return fmt.Errorf("SG %s missing", *sg.ID) }
}

if _, err := t.Cloud.ELBV2().SetSecurityGroups(ctx, request); err != nil {
  var nf *elbv2types.SecurityGroupNotFoundException
  if errors.As(err, &nf) { /* recreate SGs then retry */ }
  return fmt.Errorf("Error updating security groups on Load Balancer: %v", err)
}

When it happens

Trigger: Calling SetSecurityGroups with a security group ID that doesn't exist, is in a different VPC than the NLB, exceeds the NLB SG limit, or when the account/VPC lacks permission; also when passing zero security groups.

Common situations: Adding a cluster security group that was deleted out-of-band; mixing SGs from peered or wrong VPC after cluster re-creation; kOps state drift where the task's SecurityGroups reference stale IDs.

Related errors

• error attaching load balancer to new subnets: %v
• error deleting ELB LoadBalancer %q: %w
• error deregistering instance %q, node %q: %w
• unknown load balancer Type: %q
• unhandled bastion LoadBalancer type %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/798f33f461e2d798. Report an issue: GitHub.