{"record":{"id":"42f529089af7e157","repo":"kubernetes/kops","slug":"error-listing-routetables-for-subnet-q-v","errorCode":null,"errorMessage":"error listing RouteTables for subnet %q: %v","messagePattern":"error listing RouteTables for subnet %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/routetableassociation.go","lineNumber":136,"sourceCode":"}\n\nfunc findExistingRouteTableForSubnet(cloud awsup.AWSCloud, subnet *Subnet) (*ec2types.RouteTable, error) {\n\tctx := context.TODO()\n\tif subnet == nil {\n\t\treturn nil, fmt.Errorf(\"subnet not set\")\n\t}\n\tif subnet.ID == nil {\n\t\treturn nil, fmt.Errorf(\"subnet ID not set\")\n\t}\n\n\tsubnetID := fi.ValueOf(subnet.ID)\n\n\trequest := &ec2.DescribeRouteTablesInput{\n\t\tFilters: []ec2types.Filter{awsup.NewEC2Filter(\"association.subnet-id\", subnetID)},\n\t}\n\tresponse, err := cloud.EC2().DescribeRouteTables(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing RouteTables for subnet %q: %v\", subnetID, err)\n\t}\n\tif response == nil || len(response.RouteTables) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.RouteTables) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple RouteTables attached to subnet\")\n\t}\n\trt := response.RouteTables[0]\n\treturn &rt, nil\n}\n\nfunc (_ *RouteTableAssociation) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *RouteTableAssociation) error {\n\tctx := context.TODO()\n\tif a == nil {\n\t\t// TODO: We might do better just to make the subnet the primary key here\n\n\t\tklog.V(2).Infof(\"Checking for existing RouteTableAssociation to subnet\")","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/routetableassociation.go#L118-L154","documentation":"Wraps an AWS EC2 API failure from DescribeRouteTables while looking up the route table attached to a subnet. kOps propagates the underlying SDK error with context so the developer knows which subnet lookup failed.","triggerScenarios":"EC2 DescribeRouteTables call fails: throttling (RequestLimitExceeded), credentials/permission errors (UnauthorizedOperation, AccessDenied), network timeouts, or API outage — during RenderAWS of a RouteTableAssociation.","commonSituations":"Accounts hitting EC2 rate limits on large clusters; IAM policies missing ec2:DescribeRouteTables for the kOps/instance role; corporate proxy or VPC endpoint issues breaking AWS SDK calls.","solutions":["Read the wrapped %v cause in the message to identify the AWS error code","If throttled, reduce API pressure or re-run; kOps has backoff but large clusters may need splitting","Verify IAM policy of the node/master role includes ec2:DescribeRouteTables","Check VPC endpoint / network connectivity to EC2 in the target region"],"exampleFix":"// IAM policy: ensure this statement exists\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeRouteTables\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"// preflight API check\naws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id> --region <region>","typeGuard":null,"tryCatchPattern":"if err := applyCluster(); err != nil {\n  var ae smithy.APIError\n  if errors.As(err, &ae) && ae.ErrorCode() == \"ThrottlingException\" {\n    time.Sleep(backoff); retry()\n  }\n}","preventionTips":["Verify the kOps instance profile has ec2:Describe* permissions before applying","Avoid running many concurrent kOps operations against one account (throttling)","Test VPC endpoint/NAT connectivity to EC2 in the target region"],"tags":["aws","ec2","api-error","route-table"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}