kubernetes/kops · error

listing ELB tags: %w

Error message

listing ELB tags: %w

What it means

Within ListELBV2LoadBalancers, after collecting load balancer ARNs on each page, the code calls ELBV2 DescribeTags to fetch tags. Failure of that call is wrapped with this message. Note tags for a page are requested in a single batched DescribeTags call.

Source

Thrown at upup/pkg/fi/cloudup/awsup/elbv2_loadbalancers.go:89

		}
		if len(page.LoadBalancers) == 0 {
			break
		}

		tagRequest := &elbv2.DescribeTagsInput{}

		for _, elb := range page.LoadBalancers {
			arn := aws.ToString(elb.LoadBalancerArn)
			byARN[arn] = &LoadBalancerInfo{LoadBalancer: elb, arn: arn}

			// TODO: Any way to filter by cluster here?

			tagRequest.ResourceArns = append(tagRequest.ResourceArns, aws.ToString(elb.LoadBalancerArn))
		}

		tagResponse, err := cloud.ELBV2().DescribeTags(ctx, tagRequest)
		if err != nil {
			return nil, fmt.Errorf("listing ELB tags: %w", err)
		}

		for _, t := range tagResponse.TagDescriptions {
			arn := aws.ToString(t.ResourceArn)

			info := byARN[arn]
			if info == nil {
				klog.Fatalf("found tag for load balancer we didn't ask for %q", arn)
			}

			info.Tags = append(info.Tags, t.Tags...)
		}
	}

	cloudTags := cloud.Tags()

	var results []*LoadBalancerInfo
	for _, v := range byARN {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant elasticloadbalancing:DescribeTags in the IAM policy of the kOps principal.
2. Handle throttling with retry/backoff; the AWS SDK retryer may need increased max attempts.
3. Inspect the wrapped error via errors.As for the specific AWS error code.
4. Re-run the listing; transient failures or concurrently deleted LBs usually clear.

Example fix

// before (IAM policy)
{"Action":["elasticloadbalancing:DescribeLoadBalancers"]}
// after
{"Action":["elasticloadbalancing:DescribeLoadBalancers","elasticloadbalancing:DescribeTags"]}

_, err := cloud.ListELBV2LoadBalancers()
if err != nil {
	var ae smithy.APIError
	if errors.As(err, &ae) && ae.ErrorCode() == "AccessDenied" {
		// surface IAM guidance: add elasticloadbalancing:DescribeTags
	}
	return err
}

When it happens

Trigger: DescribeTags fails for the batched load balancer ARNs: IAM permission missing for elasticloadbalancing:DescribeTags, throttling when many pages are listed, ARNs revoked/deleted between list and tag calls, or API/network errors.

Common situations: Least-privilege IAM policies that grant DescribeLoadBalancers but not DescribeTags; large accounts with many load balancers hitting DescribeTags rate limits; load balancers deleted concurrently by other automation.

Related errors

• listing ELB TargetGroup tags: %w
• provider ID cannot be empty
• Found NLB %q linked to DNS name %q, but it did not have a Na
• error adding AWS Tags to EBS Volume: %v
• Unable to tag subnet %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/37b959398f78d7a0. Report an issue: GitHub.