{"record":{"id":"32b4d5643376abf6","repo":"kubernetes/kops","slug":"associatedroutetable-not-provided","errorCode":null,"errorMessage":"AssociatedRouteTable not provided","messagePattern":"AssociatedRouteTable not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":356,"sourceCode":"\t\treturn fmt.Errorf(\"Subnet ID not set\")\n\t}\n\n\t// TODO: AssociatedNatgateway tag is obsolete - we can get from the route table instead\n\ttags := make(map[string]string)\n\ttags[\"AssociatedNatgateway\"] = *id\n\terr = t.AddAWSTags(*e.Subnet.ID, tags)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to tag subnet %v\", err)\n\t}\n\n\t// If this is a shared NGW, we need to tag it\n\t// The tag that implies \"shared\" is `AssociatedNatgateway`=> NGW-ID\n\t// This is better than just a tag that's shared because this lets us create a whitelist of these NGWs\n\t// without doing a bunch more work in `kutil/delete_cluster.go`\n\n\tif fi.ValueOf(e.Shared) {\n\t\tif e.AssociatedRouteTable == nil {\n\t\t\treturn fmt.Errorf(\"AssociatedRouteTable not provided\")\n\t\t}\n\t\tklog.V(2).Infof(\"tagging route table %s to track shared NGW\", fi.ValueOf(e.AssociatedRouteTable.ID))\n\t\terr = t.AddAWSTags(fi.ValueOf(e.AssociatedRouteTable.ID), tags)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"unable to tag route table %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\ntype terraformNATGateway struct {\n\tAllocationID *terraformWriter.Literal `cty:\"allocation_id\"`\n\tSubnetID     *terraformWriter.Literal `cty:\"subnet_id\"`\n\tTag          map[string]string        `cty:\"tags\"`\n}\n\nfunc (_ *NatGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *NatGateway) error {","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L338-L374","documentation":"For shared NAT gateways (e.Shared == true), RenderAWS requires an AssociatedRouteTable so it can tag the route table to track the shared NGW. If Shared is set but no route table is provided, it returns \"AssociatedRouteTable not provided\".","triggerScenarios":"fi.ValueOf(e.Shared) is true during RenderAWS while e.AssociatedRouteTable == nil — i.e. a spec declares the NAT gateway as shared/reused but omits the route table reference.","commonSituations":"Converting a cluster to use a pre-existing NAT gateway but forgetting the associated route table; generated spec from an older kOps version missing the field; hand-edited cluster.yaml.","solutions":["Set the AssociatedRouteTable field on the shared NatGateway task in the cluster spec to the route table that should carry the default route","Verify the route table reference has a resolvable ID (subsequent tagging needs it)","Re-run kops update after correcting the spec"],"exampleFix":"// before (spec)\nnatGateway: { shared: true } // no routeTable\n// after\nnatGateway: { shared: true, associatedRouteTable: rt-12345678 }","handlingStrategy":"validation","validationCode":"if fi.ValueOf(nat.Shared) && nat.AssociatedRouteTable == nil {\n    return fmt.Errorf(\"shared nat gateway requires associatedRouteTable in spec\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever setting shared: true, also supply the associated route table","Validate the cluster spec with kops before applying","Document shared-NGW requirements for the team"],"tags":["aws","nat-gateway","shared","config"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}