kubernetes/kops · error

listing ELB TargetGroup tags: %w

Error message

listing ELB TargetGroup tags: %w

What it means

Inside ListELBV2TargetGroups, the batched ELBV2 DescribeTags call for the page's target group ARNs can fail; the error is wrapped with this message. Like the load balancer variant, it is usually an IAM, throttling, or transient API problem rather than a code bug.

Source

Thrown at upup/pkg/fi/cloudup/awsup/elbv2_targetgroups.go:83

		if err != nil {
			return nil, fmt.Errorf("listing ELB TargetGroups: %w", err)
		}
		if len(page.TargetGroups) == 0 {
			break
		}

		tagRequest := &elbv2.DescribeTagsInput{}

		for _, tg := range page.TargetGroups {
			arn := aws.ToString(tg.TargetGroupArn)
			byARN[arn] = &TargetGroupInfo{TargetGroup: tg, ARN: arn}

			tagRequest.ResourceArns = append(tagRequest.ResourceArns, aws.ToString(tg.TargetGroupArn))
		}

		tagResponse, err := cloud.ELBV2().DescribeTags(ctx, tagRequest)
		if err != nil {
			return nil, fmt.Errorf("listing ELB TargetGroup tags: %w", err)
		}

		for _, t := range tagResponse.TagDescriptions {
			arn := aws.ToString(t.ResourceArn)

			info := byARN[arn]
			if info == nil {
				klog.Fatalf("found tag for load balancer we didn't ask for %q", arn)
			}

			info.Tags = append(info.Tags, t.Tags...)
		}
	}

	cloudTags := cloud.Tags()

	var results []*TargetGroupInfo
	for _, v := range byARN {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add elasticloadbalancing:DescribeTags to the IAM policy.
2. Retry with exponential backoff on throttling errors.
3. Inspect the wrapped SDK error code via errors.As to distinguish AccessDenied vs Throttling vs not-found.
4. Re-run; if target groups were concurrently deleted, listing again will succeed.

tgs, err := cloud.ListELBV2TargetGroups()
if err != nil {
	var ae smithy.APIError
	if errors.As(err, &ae) && strings.Contains(ae.ErrorMessage(), "DescribeTags") || ae.ErrorCode() == "AccessDenied" {
		// report missing elasticloadbalancing:DescribeTags permission
	}
	return err
}

When it happens

Trigger: DescribeTags call for target group ARNs fails: missing elasticloadbalancing:DescribeTags permission, throttling with many target groups, target groups deleted between listing and tagging, network errors.

Common situations: Restricted IAM roles used by CI; accounts with hundreds of target groups hitting DescribeTags limits; race conditions with external tooling deleting target groups mid-listing.

Related errors

• listing ELB tags: %w
• provider ID cannot be empty
• error deleting TargetGroup %q: %v
• Found NLB %q linked to DNS name %q, but it did not have a Na
• error adding AWS Tags to EBS Volume: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7e85462ad0b5b664. Report an issue: GitHub.