kubernetes/kops · error

target group not yet created (arn not set)

Error message

target group not yet created (arn not set)

What it means

When creating a new listener (a == nil), RenderAWS resolves the target group ARN from e.TargetGroup.ARN; if empty, the target group hasn't been created yet and this error is returned. A listener's forward action requires an existing target group ARN.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go:178

		klog.Warningf("deleting ELB listener %q for required changes (%+v)", a.listenerArn, changes)

		// delete the listener before recreating it
		_, err := t.Cloud.ELBV2().DeleteListener(ctx, &elbv2.DeleteListenerInput{
			ListenerArn: &a.listenerArn,
		})
		if err != nil {
			return fmt.Errorf("error deleting load balancer listener with arn=%q: %w", e.listenerArn, err)
		}
		a = nil
	}

	if a == nil {
		if e.TargetGroup == nil {
			return fi.RequiredField("TargetGroup")
		}
		targetGroupARN := fi.ValueOf(e.TargetGroup.ARN)
		if targetGroupARN == "" {
			return fmt.Errorf("target group not yet created (arn not set)")
		}
		request := &elbv2.CreateListenerInput{
			DefaultActions: []elbv2types.Action{
				{
					TargetGroupArn: aws.String(targetGroupARN),
					Type:           elbv2types.ActionTypeEnumForward,
				},
			},
			LoadBalancerArn: aws.String(loadBalancerArn),
			Port:            aws.Int32(int32(e.Port)),
		}

		if e.SSLCertificateID != "" {
			request.Certificates = []elbv2types.Certificate{}
			request.Certificates = append(request.Certificates, elbv2types.Certificate{
				CertificateArn: aws.String(e.SSLCertificateID),
			})
			request.Protocol = elbv2types.ProtocolEnumTls

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check earlier apply logs for target group creation errors and fix the root cause
2. Ensure the listener task references the TargetGroup task so fi orders it correctly
3. Re-run kops update cluster once the target group exists
4. Verify the target group's VPC matches the NLB's VPC to avoid downstream create failures

Example fix

// before: standalone TG reference
listener.TargetGroup = &NetworkLoadBalancerTargetGroup{Name: aws.String("api")}
// after: link the task for ordering
listener.TargetGroup = tgTask // the actual task instance in the target map

if e.TargetGroup == nil { return fi.RequiredField("TargetGroup") }
if fi.ValueOf(e.TargetGroup.ARN) == "" {
  return fmt.Errorf("ensure the NetworkLoadBalancerTargetGroup task succeeded before the listener")
}

targetGroupARN := fi.ValueOf(e.TargetGroup.ARN)
if targetGroupARN == "" {
  return fmt.Errorf("target group not yet created (arn not set)")
}
// inspect earlier target-group errors, then re-run apply

When it happens

Trigger: TargetGroup task not yet applied (ARN unset) when the listener renders; target group creation failed earlier in the apply; task dependency not declared so ordering is wrong.

Common situations: First cluster bring-up with a failing target group step (e.g. VPC/subnet errors) that leaves the TG absent; missing dependency wiring between listener and target group tasks.

Related errors

• load balancer not yet created (arn not set)
• error deleting TargetGroup %q: %v
• error querying for NLB listeners :%v
• found multiple listeners matching %+v
• error deleting load balancer listener with arn=%q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ff7550f54794e285. Report an issue: GitHub.