What causes "load balancer not yet created (arn not set)" in kubernetes/kops?

Ensure the NetworkLoadBalancer task ran successfully before the listener task (check earlier errors in the apply log)

load balancer not yet created (arn not set)

Error message

load balancer not yet created (arn not set)

What it means

During RenderAWS, the listener task reads e.NetworkLoadBalancer.loadBalancerArn; if the referenced NLB task has not been applied yet (its ARN is still empty), this error is returned. Listener creation depends on the NLB existing first in the same apply.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go:155

}

func (e *NetworkLoadBalancerListener) Normalize(c *fi.CloudupContext) error {
	return nil
}

func (*NetworkLoadBalancerListener) CheckChanges(a, e, changes *NetworkLoadBalancerListener) error {
	return nil
}

func (*NetworkLoadBalancerListener) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *NetworkLoadBalancerListener) error {
	ctx := context.TODO()

	if e.NetworkLoadBalancer == nil {
		return fi.RequiredField("NetworkLoadBalancer")
	}
	loadBalancerArn := e.NetworkLoadBalancer.loadBalancerArn
	if loadBalancerArn == "" {
		return fmt.Errorf("load balancer not yet created (arn not set)")
	}

	if a != nil {
		// TODO: Can we do better here?
		klog.Warningf("deleting ELB listener %q for required changes (%+v)", a.listenerArn, changes)

		// delete the listener before recreating it
		_, err := t.Cloud.ELBV2().DeleteListener(ctx, &elbv2.DeleteListenerInput{
			ListenerArn: &a.listenerArn,
		})
		if err != nil {
			return fmt.Errorf("error deleting load balancer listener with arn=%q: %w", e.listenerArn, err)
		}
		a = nil
	}

	if a == nil {
		if e.TargetGroup == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Ensure the NetworkLoadBalancer task ran successfully before the listener task (check earlier errors in the apply log)
Verify the listener task declares its dependency via e.NetworkLoadBalancer so fi ordering is enforced
Re-run kops update cluster once the NLB exists
If NLB creation failed, fix that root cause first — this error is secondary

Example fix

// before: listener missing dependency
// (no NetworkLoadBalancer linked)
// after
listener := &NetworkLoadBalancerListener{
  NetworkLoadBalancer: nlbTask,
  TargetGroup: tgTask,
  Port: 443,
}

Defensive patterns

Strategy: validation

Validate before calling

if e.NetworkLoadBalancer == nil { return fi.RequiredField("NetworkLoadBalancer") }
if e.NetworkLoadBalancer.loadBalancerArn == "" {
  return fmt.Errorf("run the NetworkLoadBalancer task first; arn not set")
}

Try / catch

loadBalancerArn := e.NetworkLoadBalancer.loadBalancerArn
if loadBalancerArn == "" {
  return fmt.Errorf("load balancer not yet created (arn not set)")
}
// fix the earlier NLB failure, then re-run apply

Prevention

Declare the NetworkLoadBalancer dependency on the listener task
Fix NLB creation errors before diagnosing listener errors
Avoid reusing partial dry-run state for real applies
Check apply logs top-down; this error is usually secondary

When it happens

Trigger: RenderAWS ordering where the NetworkLoadBalancerListener runs before the NetworkLoadBalancer task has executed and populated loadBalancerArn; a failed NLB create earlier in the apply leaving the ARN empty.

Common situations: First-time cluster bring-up where NLB creation failed silently or was skipped; task dependency wiring broken so ordering isn't enforced; dry-run state reuse with incomplete NLB state.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/87b4e014584f5a42. Report an issue: GitHub.