kubernetes/kops · error

unexpected error fetching tags for resource: %v

Error message

unexpected error fetching tags for resource: %v

What it means

AWSAPITarget.AddELBV2Tags wraps errors from Cloud.GetELBV2Tags — reading the current tag set of an ELBv2 (ALB/NLB) resource by ARN — with this message during tag reconciliation driven by RenderAWS. It means kOps could not determine actual tags, so it aborts the AddELBV2Tags reconciliation instead of guessing.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_apitarget.go:71

	return t.Cloud.GetTags(id)
}

func (t *AWSAPITarget) CreateTags(id string, tags map[string]string) error {
	return t.Cloud.CreateTags(id, tags)
}

func (t *AWSAPITarget) DeleteTags(id string, tags map[string]string) error {
	return t.Cloud.DeleteTags(id, tags)
}

func (t *AWSAPITarget) UpdateTags(id string, tags map[string]string) error {
	return t.Cloud.UpdateTags(id, tags)
}

func (t *AWSAPITarget) AddELBV2Tags(ResourceArn string, expected map[string]string) error {
	actual, err := t.Cloud.GetELBV2Tags(ResourceArn)
	if err != nil {
		return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
	}

	missing := map[string]string{}
	for k, v := range expected {
		actualValue, found := actual[k]
		if found && actualValue == v {
			continue
		}
		missing[k] = v
	}

	if len(missing) != 0 {
		klog.V(4).Infof("adding tags to %q: %v", ResourceArn, missing)
		err := t.Cloud.CreateELBV2Tags(ResourceArn, missing)
		if err != nil {
			return fmt.Errorf("error adding tags to ELBV2 %q: %v", ResourceArn, err)
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant elasticloadbalancing:DescribeTags to the kOps IAM role
2. Verify the ELBV2 resource still exists in the expected region (ls or aws elbv2 describe-tags with the ARN)
3. Re-run kops update cluster after transient throttling clears
4. Ensure the ARN belongs to the same account/region as the target

Example fix

// before
actual, err := t.Cloud.GetELBV2Tags(ResourceArn)
if err != nil {
	return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
}
// after: tolerate NotFound as empty tag set
if err != nil && awsup.AWSErrorCode(err) != "ResourceNotFound" {
	return fmt.Errorf("unexpected error fetching tags for resource: %v", err)
}

if !iamAllows("elasticloadbalancing:DescribeTags") { return errors.New("IAM policy missing elasticloadbalancing:DescribeTags") }
out, _ := elbv2.DescribeTags(&elbv2.DescribeTagsInput{ResourceArns: []string{arn}})
if len(out.TagDescriptions) == 0 { return errors.New("ELBV2 resource not found: " + arn) }

err := target.AddELBV2Tags(arn, expectedTags)
if err != nil {
	var retryable bool
	if aerr, ok := err.(awserr.Error); ok { retryable = aerr.Code() == "Throttling" }
	if retryable { time.Sleep(backoff); return AddELBV2Tags(arn, expectedTags) }
	return err
}

When it happens

Trigger: RenderAWS calls AddELBV2Tags for a load balancer/listener/target-group ARN and GetELBV2Tags fails (API error, permission, or resource-not-found).

Common situations: IAM missing elasticloadbalancing:DescribeTags; ALB/NLB deleted out-of-band between create and tagging; temporary AWS throttling; ARN from another region/account.

Related errors

• Found NLB %q linked to DNS name %q, but it did not have a Na
• error adding tags to ELBV2 %q: %v
• error removing tags from ELBV2 %q: %v
• listing ELB tags: %w
• listing ELB TargetGroup tags: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/738a565d9e00a2af. Report an issue: GitHub.