kubernetes/kops · error

failed to attach target groups: %v

Error message

failed to attach target groups: %v

What it means

kops wraps the AWS AutoScaling AttachLoadBalancerTargetGroups API error when attaching target groups (NLB/ALB) to an AutoScalingGroup in RenderAWS. AWS rejected one of the per-target-group attach calls.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/autoscalinggroup.go:688

			if _, err := t.Cloud.Autoscaling().CreateOrUpdateTags(ctx, updateTagsRequest); err != nil {
				return fmt.Errorf("error updating AutoscalingGroup tags: %v", err)
			}
		}

		if detachLBRequest != nil {
			if _, err := t.Cloud.Autoscaling().DetachLoadBalancers(ctx, detachLBRequest); err != nil {
				return fmt.Errorf("error detatching LoadBalancers: %v", err)
			}
		}
		if attachLBRequest != nil {
			if _, err := t.Cloud.Autoscaling().AttachLoadBalancers(ctx, attachLBRequest); err != nil {
				return fmt.Errorf("error attaching LoadBalancers: %v", err)
			}
		}
		if len(attachTGRequests) > 0 {
			for _, attachTGRequest := range attachTGRequests {
				if _, err := t.Cloud.Autoscaling().AttachLoadBalancerTargetGroups(ctx, attachTGRequest); err != nil {
					return fmt.Errorf("failed to attach target groups: %v", err)
				}
			}
		}
	}

	return nil
}

// UseMixedInstancesPolicy checks if we should add a mixed instances policy to the asg
func (e *AutoscalingGroup) UseMixedInstancesPolicy() bool {
	if e.LaunchTemplate == nil {
		return false
	}
	// @check if any of the mixed instance policies settings are toggled
	if e.MixedOnDemandAboveBase != nil {
		return true
	}
	if e.MixedOnDemandBase != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops update cluster --yes` or `kops toolbox dump` to refresh target group ARNs; if the NLB was recreated, re-export or re-apply so the ARN updates.
2. Verify the target group VPC matches the ASG subnets VPC.
3. Confirm IAM allows autoscaling:AttachLoadBalancerTargetGroups and elasticloadbalancing:DescribeTargetGroups.
4. Retry after backoff if throttled.

// verify target group ARN exists and VPC matches
out, err := elbv2Svc.DescribeTargetGroups(&elbv2.DescribeTargetGroupsInput{TargetGroupArns: []string{arn}})
if err != nil { return fmt.Errorf("target group %s not found: %w", arn, err) }
if *out.TargetGroups[0].VpcId != asgVpcID { return errors.New("target group VPC mismatch") }

if _, err := svc.AttachLoadBalancerTargetGroups(ctx, req); err != nil {
  if isNotFound(err) {
    return fmt.Errorf("stale target group ARN - re-run kops update cluster: %w", err)
  }
  return retry(err)
}

When it happens

Trigger: During ASG update with len(attachTGRequests) > 0, Autoscaling().AttachLoadBalancerTargetGroups fails: target group ARN invalid/deleted, target group in different VPC than ASG subnets, throttling, or missing autoscaling:AttachLoadBalancerTargetGroups permission.

Common situations: NLB was deleted and recreated so its target group ARN changed while kops cached the old one; loadBalancer attachment referencing a target group from another VPC; permissions tightened by SCP.

Related errors

• error updating AutoscalingGroup: %v
• error deleting old AutoscalingGroup tags: %v
• error updating AutoscalingGroup tags: %v
• error detatching LoadBalancers: %v
• error attaching LoadBalancers: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ec22497f748bafb2. Report an issue: GitHub.