{"record":{"id":"3d5fc52d4e14f42d","repo":"kubernetes/kops","slug":"nat-ec2-instance-q-not-found","errorCode":null,"errorMessage":"NAT EC2 Instance %q not found","messagePattern":"NAT EC2 Instance %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/instance.go","lineNumber":218,"sourceCode":"func (e *Instance) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *Instance) CheckChanges(a, e, changes *Instance) error {\n\tif a != nil {\n\t\tif !fi.ValueOf(e.Shared) && e.Name == nil {\n\t\t\treturn fi.RequiredField(\"Name\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (_ *Instance) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *Instance) error {\n\tctx := context.TODO()\n\tif a == nil {\n\n\t\tif fi.ValueOf(e.Shared) {\n\t\t\treturn fmt.Errorf(\"NAT EC2 Instance %q not found\", fi.ValueOf(e.ID))\n\t\t}\n\n\t\tif e.ImageID == nil {\n\t\t\treturn fi.RequiredField(\"ImageID\")\n\t\t}\n\t\timage, err := t.Cloud.ResolveImage(fi.ValueOf(e.ImageID))\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Instance with Name:%q\", fi.ValueOf(e.Name))\n\t\trequest := &ec2.RunInstancesInput{\n\t\t\tImageId:      image.ImageId,\n\t\t\tInstanceType: e.InstanceType,\n\t\t\tMinCount:     aws.Int32(1),\n\t\t\tMaxCount:     aws.Int32(1),\n\t\t}\n","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/instance.go#L200-L236","documentation":"In Instance.RenderAWS, when the task is creating a new instance (no existing 'actual' state) but the task is marked Shared, kOps expects the instance to already exist and be discoverable by ID. If it was not found during Find, RenderAWS refuses to create a new one and fails with 'NAT EC2 Instance %q not found'. Shared instances are treated as pre-existing external infrastructure (historically NAT instances), so kOps never creates them.","triggerScenarios":"Rendering an Instance task with Shared=true where a==nil (Find returned no matching instance), e.g. the ID is unset, points to a deleted/terminated instance, or Find could not match by name/tags in the target region/VPC.","commonSituations":"Config marks a NAT/bastion instance as shared but the instance ID is missing from the cluster spec; the referenced instance was terminated or lives in another region/account; typo'd or stale ID after cluster import; running kops against a different VPC than where the shared instance exists.","solutions":["Set the correct instance ID for the shared Instance task in the cluster spec (kops edit cluster) and re-run kops update.","Verify the instance exists: `aws ec2 describe-instances --instance-ids <id>` in the same region/VPC kOps targets.","If kOps should manage the instance, remove Shared:true from the task so it creates the instance.","Re-run discovery: ensure name tags match what Find searches for, or point the task at the right cluster.","If the shared instance is truly gone, restore it (or its snapshot) or un-share the task."],"exampleFix":"// before (cluster spec, instance task)\ninstance/k8s-cluster-a-nat:\n  shared: true\n  # id missing -> RenderAWS fails\n// after\ninstance/k8s-cluster-a-nat:\n  shared: true\n  id: i-0abc123def4567890","handlingStrategy":"validation","validationCode":"// Before applying a cluster with a shared instance, verify the ID exists\ngoVerify := func(instID, region string) error {\n\tcfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion(region))\n\tclient := ec2.NewFromConfig(cfg)\n\tout, err := client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n\t\tInstanceIds: []string{instID},\n\t})\n\tif err != nil || len(out.Reservations) == 0 {\n\t\treturn fmt.Errorf(\"shared instance %s not found in %s\", instID, region)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"err := applyCluster(ctx)\nif err != nil && strings.Contains(err.Error(), \"not found\") && strings.Contains(err.Error(), \"NAT EC2 Instance\") {\n\t// shared instance missing: prompt to fix the ID or un-share the task\n\treturn fmt.Errorf(\"shared instance referenced in spec does not exist; set a valid id or remove shared:true: %w\", err)\n}\nreturn err","preventionTips":["Only set shared:true when you also set a valid, existing instance id.","Keep the shared instance in the same region and VPC as the cluster.","Run `kops get cluster -o yaml` and sanity-check shared instance ids before `kops update`.","Avoid terminating shared NAT instances without updating the cluster spec first."],"tags":["aws","ec2","shared-resource","nat-instance","kops"],"backgroundTag":"shared-resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}