{"record":{"id":"4a1f81670ea15d99","repo":"kubernetes/kops","slug":"cannot-route-ipv4-to-an-egressonlyinternetgateway","errorCode":null,"errorMessage":"cannot route IPv4 to an EgressOnlyInternetGateway","messagePattern":"cannot route IPv4 to an EgressOnlyInternetGateway","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/route.go","lineNumber":149,"sourceCode":"}\n\nfunc (s *Route) CheckChanges(a, e, changes *Route) error {\n\tif a == nil {\n\t\t// TODO: Create validate method?\n\t\tif e.RouteTable == nil {\n\t\t\treturn fi.RequiredField(\"RouteTable\")\n\t\t}\n\t\tif e.CIDR == nil && e.IPv6CIDR == nil {\n\t\t\treturn fi.RequiredField(\"CIDR/IPv6CIDR\")\n\t\t}\n\t\tif e.CIDR != nil && e.IPv6CIDR != nil {\n\t\t\treturn fmt.Errorf(\"cannot set more than one CIDR or IPv6CIDR\")\n\t\t}\n\t\ttargetCount := 0\n\t\tif e.EgressOnlyInternetGateway != nil {\n\t\t\ttargetCount++\n\t\t\tif e.CIDR != nil {\n\t\t\t\treturn fmt.Errorf(\"cannot route IPv4 to an EgressOnlyInternetGateway\")\n\t\t\t}\n\t\t}\n\t\tif e.InternetGateway != nil {\n\t\t\ttargetCount++\n\t\t}\n\t\tif e.Instance != nil {\n\t\t\ttargetCount++\n\t\t}\n\t\tif e.NatGateway != nil {\n\t\t\ttargetCount++\n\t\t}\n\t\tif e.TransitGatewayID != nil {\n\t\t\ttargetCount++\n\t\t}\n\t\tif e.VPCPeeringConnectionID != nil {\n\t\t\ttargetCount++\n\t\t}\n\t\tif targetCount == 0 {","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/route.go#L131-L167","documentation":"This error is raised when a Route task specifies an EgressOnlyInternetGateway as its target but also sets an IPv4 CIDR destination. Egress-only internet gateways are IPv6-only constructs; they cannot be used for IPv4 traffic, so AWS (and kOps) reject the combination.","triggerScenarios":"Setting `egressOnlyInternetGateway` on a route whose destination is an IPv4 `cidr` instead of an `ipv6Cidr`.","commonSituations":"Misconfiguring an IPv6 egress route by using an IPv4 CIDR copied from an internet-gateway route; confusion between regular IGW and egress-only IGW semantics.","solutions":["Change the route destination from CIDR (IPv4) to IPv6CIDR (e.g. ::/0)","Replace the target with a regular InternetGateway if IPv4 egress is actually needed","Remove the EgressOnlyInternetGateway field entirely if unintended"],"exampleFix":"// before\nroute:\n  cidr: 0.0.0.0/0\n  egressOnlyInternetGateway: eigw-123\n// after\nroute:\n  ipv6Cidr: ::/0\n  egressOnlyInternetGateway: eigw-123","handlingStrategy":"validation","validationCode":"func validateEgressOnlyRoute(r Route) error {\n\tif r.EgressOnlyInternetGateway != nil {\n\t\tif r.CIDR != nil {\n\t\t\treturn errors.New(\"cannot route IPv4 to an EgressOnlyInternetGateway\")\n\t\t}\n\t\tif r.IPv6CIDR == nil {\n\t\t\treturn errors.New(\"egress-only routes require ipv6Cidr\")\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember: EgressOnlyInternetGateway is IPv6-only — always pair with ipv6Cidr ::/0","Use a regular InternetGateway for IPv4 egress"],"tags":["aws","route","ipv6","egress-only-igw"],"backgroundTag":"ipv6-route-misconfiguration","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}