{"record":{"id":"1c868df2e46245b0","repo":"kubernetes/kops","slug":"error-finding-associatednatgatewayroutetable-v","errorCode":null,"errorMessage":"error finding AssociatedNatGatewayRouteTable: %v","messagePattern":"error finding AssociatedNatGatewayRouteTable: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/elastic_ip.go","lineNumber":77,"sourceCode":"func (e *ElasticIP) CompareWithID() *string {\n\treturn e.ID\n}\n\n// Find returns the actual ElasticIP state, or nil if not found\nfunc (e *ElasticIP) Find(c *fi.CloudupContext) (*ElasticIP, error) {\n\treturn e.find(c.Context(), awsup.GetCloud(c))\n}\n\n// find will attempt to look up the elastic IP from AWS\nfunc (e *ElasticIP) find(ctx context.Context, cloud awsup.AWSCloud) (*ElasticIP, error) {\n\tpublicIP := e.PublicIP\n\tallocationID := e.ID\n\n\t// Find via RouteTable -> NatGateway -> ElasticIP\n\tif allocationID == nil && publicIP == nil && e.AssociatedNatGatewayRouteTable != nil {\n\t\tngw, err := findNatGatewayFromRouteTable(ctx, cloud, e.AssociatedNatGatewayRouteTable)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding AssociatedNatGatewayRouteTable: %v\", err)\n\t\t}\n\n\t\tif ngw == nil {\n\t\t\tklog.V(2).Infof(\"AssociatedNatGatewayRouteTable not found\")\n\t\t} else {\n\t\t\tif len(ngw.NatGatewayAddresses) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"NatGateway %q has no addresses\", *ngw.NatGatewayId)\n\t\t\t}\n\t\t\tif len(ngw.NatGatewayAddresses) > 1 {\n\t\t\t\treturn nil, fmt.Errorf(\"NatGateway %q has multiple addresses\", *ngw.NatGatewayId)\n\t\t\t}\n\t\t\tallocationID = ngw.NatGatewayAddresses[0].AllocationId\n\t\t\tif allocationID == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"NatGateway %q has nil addresses\", *ngw.NatGatewayId)\n\t\t\t} else {\n\t\t\t\tklog.V(2).Infof(\"Found ElasticIP AllocationID %q via NatGateway\", *allocationID)\n\t\t\t}\n\t\t}","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/elastic_ip.go#L59-L95","documentation":"find() in the Elastic IP task attempts to locate an EIP by traversing RouteTable -> NatGateway -> ElasticIP when neither the allocation ID nor the public IP is known. This indirection calls findNatGatewayFromRouteTable on the AssociatedNatGatewayRouteTable; any failure in that lookup (AWS API error) is wrapped as this error, aborting discovery of the EIP.","triggerScenarios":"find() runs during reconciliation of an Elastic IP task with ID==nil, publicIP==nil, and AssociatedNatGatewayRouteTable set; findNatGatewayFromRouteTable's EC2 DescribeRouteTables/DescribeNatGateways calls fail (permissions, network, throttling, invalid route table ID).","commonSituations":"Applying a cluster where the EIP is discovered via its associated NAT gateway's route table; route table deleted or ID wrong; IAM missing ec2:DescribeNatGateways/ec2:DescribeRouteTables; transient AWS API errors or rate limiting during wide applies.","solutions":["Inspect the wrapped inner error to identify the AWS API failure (access denied vs not found vs throttling).","Verify the route table ID exists in the region: aws ec2 describe-route-tables --route-table-ids rtb-...","Grant ec2:DescribeNatGateways and ec2:DescribeRouteTables to the kOps IAM role.","Alternatively set the EIP allocation ID (e.ID) or publicIP directly in the task so the route-table traversal is skipped entirely.","Retry the apply after transient AWS API issues."],"exampleFix":"// before (EIP discovered indirectly, fails)\nngw, err := findNatGatewayFromRouteTable(ctx, cloud, e.AssociatedNatGatewayRouteTable)\n// after — pin the allocation explicitly in the task to bypass discovery:\n// eip := &awstasks.ElasticIP{ ID: fi.PtrTo(\"eipalloc-0abc123456789def0\"), AssociatedNatGatewayRouteTable: rtb }\n// (and fix underlying IAM/API error before retrying)","handlingStrategy":"try-catch","validationCode":"// confirm the route table and its NAT gateway exist before apply\naws ec2 describe-route-tables --route-table-ids rtb-0abc123456789def0\naws ec2 describe-nat-gateways --filter Name=route-table-id,Values=rtb-0abc123456789def0","typeGuard":null,"tryCatchPattern":"if err := run(); err != nil {\n    if strings.Contains(err.Error(), \"error finding AssociatedNatGatewayRouteTable\") {\n        // check IAM for ec2:DescribeNatGateways / ec2:DescribeRouteTables,\n        // verify the route table exists, then retry\n    }\n    return err\n}","preventionTips":["Pin the EIP allocation ID in the task instead of relying on route-table discovery.","Grant ec2:DescribeNatGateways and ec2:DescribeRouteTables to the kOps IAM role.","Verify NAT gateway/route table drift after manual AWS console changes.","Use kops toolbox dump / cluster validation to catch missing NAT associations early."],"tags":["aws","ec2","nat-gateway","elastic-ip","route-table"],"backgroundTag":"aws-resource-discovery-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}