kubernetes/kops · error

unexpected error fetching tags for resource: %v

Error message

unexpected error fetching tags for resource: %v

What it means

addAWSTags could not read the current tags of the resource (via GetTags, which itself retries eventual-consistency errors), so it cannot compute which tags are missing. The wrapped %v carries the underlying DescribeTags failure.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1390

	if len(extra) > 0 {
		klog.V(4).Infof("Removing tags from %q: %v", resourceID, missing)
		err := deleteTags(c, resourceID, extra)
		if err != nil {
			return err
		}
	}

	return nil
}

func (c *awsCloudImplementation) AddAWSTags(id string, expected map[string]string) error {
	return addAWSTags(c, id, expected)
}

func addAWSTags(c AWSCloud, id string, expected map[string]string) error {
	actual, err := c.GetTags(id)
	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	missing := map[string]string{}
	for k, v := range expected {
		actualValue, found := actual[k]
		if found && actualValue == v {
			continue
		}
		missing[k] = v
	}

	if len(missing) != 0 {
		klog.V(4).Infof("adding tags to %q: %v", id, missing)

		err := c.CreateTags(id, missing)
		if err != nil {
			return fmt.Errorf("error adding tags to resource %q: %v", id, err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the resource ID exists in the target region with `aws ec2 describe-tags`.
2. Inspect the wrapped error for Throttling and reduce concurrency or add backoff.
3. Verify IAM policy includes ec2:DescribeTags.
4. Re-run kops after a short delay if the resource was just created.

// Verify the resource is visible to tag APIs before addAWSTags
if _, err := c.GetTags(id); err != nil {
    time.Sleep(10 * time.Second) // allow eventual consistency
}

err := addAWSTags(c, id, expected)
if err != nil {
    var throttle smithy.APIError
    if errors.As(err, &throttle) && strings.Contains(throttle.ErrorCode(), "Throttling") {
        time.Sleep(backoff)
        return addAWSTags(c, id, expected)
    }
    return err
}

When it happens

Trigger: DescribeTags called with an invalid/non-existent resource ID, throttling from many concurrent tag fetches, or IAM missing ec2:DescribeTags, while validating that expected tags are present.

Common situations: Applying tags to a resource still being created; throttled account under large cluster fan-out; misconfigured region so the resource is not found in the target region.

Related errors

• found multiple Volumes with name: %s
• error adding AWS Tags to EBS Volume: %v
• found multiple EgressOnlyInternetGateways matching tags
• error querying tags for ElasticIP: %v
• Unable to tag subnet %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/54fa746e5040f84f. Report an issue: GitHub.