kubernetes/kops · error

looking for AWS NLB: %w

Error message

looking for AWS NLB: %w

What it means

In findDNSName (aws_cloud.go), when the cluster API load balancer class is Network (NLB), kOps lists all ELBv2 load balancers to locate the cluster's NLB DNS name. If ListELBV2LoadBalancers fails, the error is wrapped as 'looking for AWS NLB: %w'. It indicates the AWS elasticloadbalancingv2 API call itself failed, not that the LB is merely absent.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1960

		return nil, fmt.Errorf("error finding aws DNSName: %v", err)
	} else if lbDnsName != "" {
		ingresses = append(ingresses, fi.ApiIngressStatus{Hostname: lbDnsName})
	}

	return ingresses, nil
}

func findDNSName(cloud AWSCloud, cluster *kops.Cluster) (string, error) {
	ctx := context.TODO()

	name := "api." + cluster.Name
	if cluster.Spec.API.LoadBalancer == nil {
		return "", nil
	}
	if cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork {
		allLoadBalancers, err := ListELBV2LoadBalancers(ctx, cloud)
		if err != nil {
			return "", fmt.Errorf("looking for AWS NLB: %w", err)
		}

		latest := FindLatestELBV2ByNameTag(allLoadBalancers, name)
		if latest != nil {
			return aws.ToString(latest.LoadBalancer.DNSName), nil
		}
	}
	return "", nil
}

// DefaultInstanceType determines an instance type for the specified cluster & instance group
func (c *awsCloudImplementation) DefaultInstanceType(cluster *kops.Cluster, ig *kops.InstanceGroup) (string, error) {
	var candidates []ec2types.InstanceType

	switch {
	case ig.Spec.Role.HasNode() || ig.Spec.Role.IsControlPlaneType():
		// t3.medium is the cheapest instance with 4GB of mem, unlimited by default, fast and has decent network
		// c5.large and c4.large are a good second option in case t3.medium is not available in the AZ

View on GitHub (pinned to 4c8573c808)

Solutions

1. Test credentials/permissions: run aws elbv2 describe-load-balancers with the same credentials kOps uses.
2. If throttled (TooManyRequestsException / Throttling), retry with backoff or reduce API call frequency.
3. Verify region configuration on the AWSCloud object matches the cluster's region.
4. Check network path to the ELBv2 endpoint (VPC endpoints, proxy, DNS).
5. Confirm no IAM SCP or permission boundary denies elasticloadbalancing read actions.

Example fix

// before: retrying immediately makes throttling worse
lb, err := ListELBV2LoadBalancers(ctx, cloud)
// after: backoff on throttling errors
var lbErr error
for i := 0; i < 3; i++ {
    if _, lbErr = ListELBV2LoadBalancers(ctx, cloud); lbErr == nil || !isThrottlingError(lbErr) { break }
    time.Sleep(time.Duration(1<<i) * time.Second)
}

creds ok := aws elbv2 describe-load-balancers --region <region> --output text; if it fails with AccessDenied, fix IAM before invoking kops.

ingresses, err := getApiIngressStatus(cloud, cluster)
if err != nil && strings.Contains(err.Error(), "looking for AWS NLB") {
    if isThrottlingOrTransient(errors.Unwrap(err)) {
        backoff.Retry(func() error { _, err = getApiIngressStatus(cloud, cluster); return err }, backoff.NewExponentialBackOff())
    }
}

When it happens

Trigger: cluster.Spec.API.LoadBalancer.Class == kops.LoadBalancerClassNetwork and ListELBV2LoadBalancers(ctx, cloud) returns an error from ec2/ELBv2 DescribeLoadBalancers — e.g. AuthFailure, throttling, invalid region, network timeout.

Common situations: IAM policy missing elasticloadbalancing:DescribeLoadBalancers; AWS API throttling in accounts with many load balancers (kOps paginates through all of them); misconfigured AWS_REGION or unavailable AWS endpoint (e.g. air-gapped environments, VPC endpoint misconfig).

Related errors

• error deleting V2 LoadBalancer %q: %v
• error creating AutoScalingGroup: %s
• error mapping DNSName %q to LoadBalancer: %v
• Found NLB %q linked to DNS name %q, but it did not have a Na
• error listing EventBridge rules: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/24a4598acc38a4a2. Report an issue: GitHub.