{"record":{"id":"49378e424678f2ba","repo":"kubernetes/kops","slug":"kops-currently-only-supports-re-use-of-either-nat","errorCode":null,"errorMessage":"kops currently only supports re-use of either NAT EC2 Instances or NAT Gateways. We will support more eventually! Please see https://github.com/kubernetes/kops/issues/1530","messagePattern":"kops currently only supports re-use of either NAT EC2 Instances or NAT Gateways\\. We will support more eventually! Please see https://github\\.com/kubernetes/kops/issues/1530","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/network.go","lineNumber":496,"sourceCode":"\t\t\t\tc.AddTask(ngw)\n\n\t\t\t} else if strings.HasPrefix(egress, \"i-\") {\n\n\t\t\t\tin = &awstasks.Instance{\n\t\t\t\t\tName:      new(egress),\n\t\t\t\t\tLifecycle: b.Lifecycle,\n\t\t\t\t\tID:        new(egress),\n\t\t\t\t\tShared:    new(true),\n\t\t\t\t\tTags:      nil, // We don't need to add tags here\n\t\t\t\t}\n\n\t\t\t\tc.EnsureTask(in)\n\t\t\t} else if strings.HasPrefix(egress, \"tgw-\") {\n\t\t\t\ttgwID = &egress\n\t\t\t} else if egress == \"External\" {\n\t\t\t\t// Nothing to do here\n\t\t\t} else {\n\t\t\t\treturn fmt.Errorf(\"kops currently only supports re-use of either NAT EC2 Instances or NAT Gateways. We will support more eventually! Please see https://github.com/kubernetes/kops/issues/1530\")\n\t\t\t}\n\t\t} else {\n\n\t\t\t// Every NGW needs a public (Elastic) IP address, every private\n\t\t\t// subnet needs a NGW, lets create it. We tie it to a subnet\n\t\t\t// so we can track it in AWS\n\t\t\teip := &awstasks.ElasticIP{\n\t\t\t\tName:                           new(zone + \".\" + b.ClusterName()),\n\t\t\t\tLifecycle:                      b.Lifecycle,\n\t\t\t\tAssociatedNatGatewayRouteTable: egressRouteTable,\n\t\t\t}\n\n\t\t\tif publicIP != \"\" {\n\t\t\t\teip.PublicIP = new(publicIP)\n\t\t\t\teip.Tags = b.CloudTags(*eip.Name, true)\n\t\t\t} else {\n\t\t\t\teip.Tags = b.CloudTags(*eip.Name, false)\n\t\t\t}","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/network.go#L478-L514","documentation":"When a subnet's `egress` value is set but does not match any supported reuse target (nat-*, eipalloc-*, i-*, tgw-*, or the literal External), the AWS network builder refuses to construct egress tasks. kops only knows how to re-use NAT Gateways, Elastic IPs, NAT EC2 instances, Transit Gateways, or an external/implicit egress path; anything else is unsupported. This is a config-value validation error at `kops update cluster` time.","triggerScenarios":"Setting `egress` on a private subnet to an arbitrary string such as a VPC endpoint ID (vpce-...), a placeholder like \"nat\", a peering connection ID (pcx-...), a typo like \"NAT-Gateway\", or a malformed resource ID.","commonSituations":"Users assuming any AWS resource ID works as egress and trying vpce- endpoints (not supported here); typos when pasting IDs; docs/examples from older kops versions using values that are no longer accepted; attempting IGW-based or proxy egress via the egress field.","solutions":["Change `egress` to one of the supported forms: empty (kops-managed NAT gateway), nat-<id>, eipalloc-<id>, i-<id>, tgw-<id>, or the literal `External`.","If you intended a VPC endpoint or proxy egress, remove egress and implement routing outside kops (e.g. route tables pointing at the endpoint), or use `External` with pre-created routes.","Verify the ID prefix with `aws ec2 describe-nat-gateways` / `describe-transit-gateways` and paste the correct resource into the spec.","Apply the fixed spec (`kops replace -f` / `kops edit cluster`) and re-run `kops update cluster`. See kops issue #1530 for supported egress options."],"exampleFix":"# before\nsubnets:\n- name: private-a\n  type: Private\n  zone: us-east-1a\n  egress: vpce-0abc123   # unsupported\n# after\nsubnets:\n- name: private-a\n  type: Private\n  zone: us-east-1a\n  egress: nat-0abc123    # supported: reuse existing NAT gateway\n# or simply omit egress to let kops create one","handlingStrategy":"validation","validationCode":"// Only allow known egress forms before handing the spec to kops\nvar egressRe = regexp.MustCompile(`^(nat-[0-9a-f]+|eipalloc-[0-9a-f]+|i-[0-9a-f]+|tgw-[0-9a-f]+|External|)$`)\nfunc validEgress(v string) bool { return egressRe.MatchString(v) }","typeGuard":"func isSupportedEgress(egress string) bool {\n    switch {\n    case egress == \"\", egress == \"External\":\n        return true\n    case strings.HasPrefix(egress, \"nat-\"), strings.HasPrefix(egress, \"eipalloc-\"),\n        strings.HasPrefix(egress, \"i-\"), strings.HasPrefix(egress, \"tgw-\"):\n        return true\n    }\n    return false\n}","tryCatchPattern":"out, err := exec.Command(\"kops\", \"update\", \"cluster\", \"--yes\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"only supports re-use of either NAT EC2 Instances or NAT Gateways\") {\n    log.Fatalf(\"egress value not supported; use nat-*/eipalloc-*/i-*/tgw-*/External or omit it\")\n}","preventionTips":["Memorize the accepted egress forms: empty, nat-, eipalloc-, i-, tgw-, External — nothing else.","Do not use egress for VPC endpoints (vpce-) or peering (pcx-); configure those via route tables instead.","Validate IDs with the AWS CLI (prefix + format) before pasting them into the cluster spec.","Track kops issue #1530 for changes to supported egress options when upgrading."],"tags":["aws","networking","egress","unsupported-value"],"backgroundTag":"unsupported-egress-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}