{"record":{"id":"6449bd57237465fe","repo":"kubernetes/kops","slug":"error-listing-natgateway-q-v","errorCode":null,"errorMessage":"error listing NatGateway %q: %v","messagePattern":"error listing NatGateway %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":192,"sourceCode":"\t\t}\n\t\tt := response.Tags[0]\n\t\tid = t.Value\n\t\tklog.V(2).Infof(\"Found NatGateway via subnet tag: %v\", *id)\n\t}\n\n\tif id != nil {\n\t\treturn findNatGatewayById(ctx, cloud, fi.ValueOf(id))\n\t}\n\n\treturn nil, nil\n}\n\nfunc findNatGatewayById(ctx context.Context, cloud awsup.AWSCloud, id string) (*ec2types.NatGateway, error) {\n\trequest := &ec2.DescribeNatGatewaysInput{}\n\trequest.NatGatewayIds = []string{id}\n\tresponse, err := cloud.EC2().DescribeNatGateways(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing NatGateway %q: %v\", id, err)\n\t}\n\n\tif response == nil || len(response.NatGateways) == 0 {\n\t\tklog.V(2).Infof(\"Unable to find NatGateway %q\", id)\n\t\treturn nil, nil\n\t}\n\tif len(response.NatGateways) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple NatGateways with id %q\", id)\n\t}\n\treturn &response.NatGateways[0], nil\n}\n\nfunc findNatGatewayFromRouteTable(ctx context.Context, cloud awsup.AWSCloud, routeTable *RouteTable) (*ec2types.NatGateway, error) {\n\t// Find via route on private route table\n\tif routeTable.ID != nil {\n\t\tklog.V(2).Infof(\"trying to match NatGateway via RouteTable %s\", *routeTable.ID)\n\t\trt, err := findRouteTableByID(ctx, cloud, *routeTable.ID)\n\t\tif err != nil {","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L174-L210","documentation":"DescribeNatGateways errored for the given NAT Gateway ID while resolving it by id (findNatGatewayById); the AWS API call itself failed — invalid/deleted ID, permissions, or throttling — as reported by the wrapped error.","triggerScenarios":"cloud.EC2().DescribeNatGateways returns err — e.g. InvalidNatGatewayID.NotFound for a stale ID, AccessDenied on the EC2 API, request throttling, or connectivity failure.","commonSituations":"NAT gateway was deleted out-of-band so stored IDs are stale; IAM policy lacks ec2:DescribeNatGateways; API rate limits during large cluster reconciliation; regional outage.","solutions":["Read the wrapped %v cause to identify the AWS error (NotFound vs AccessDenied vs throttling)","If InvalidNatGatewayID.NotFound, remove stale references (subnet AssociatedNatgateway tag / route table routes) and let kops recreate the gateway","Verify IAM permissions include ec2:DescribeNatGateways and ec2:CreateTags in the cluster region","Retry on throttling; reduce concurrent reconciliation or increase client rate limits"],"exampleFix":"// before: retrying blindly with a deleted gateway ID\nfindNatGatewayById(ctx, cloud, \"nat-gone\")\n// after: clear the stale reference so kops provisions a new NAT gateway\naws ec2 delete-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway\nkops update cluster --name mycluster.example.com --yes","handlingStrategy":"try-catch","validationCode":"// verify API access and ID beforehand\n_, err := ec2Client.DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{id}})\nif err != nil { log.Printf(\"pre-check failed for %s: %v\", id, err) }","typeGuard":"func natGatewayExists(id string) bool {\n  var aerr awserr.Error\n  _ = aerr // inspect err code: InvalidNatGatewayID.NotFound → stale reference\n  return false\n}","tryCatchPattern":"gw, err := findNatGatewayById(ctx, cloud, id)\nif err != nil {\n  var nf *smithy.GenericAPIError\n  if errors.As(err, &nf) && nf.Code == \"InvalidNatGatewayID.NotFound\" {\n    // clear stale references and let kops recreate\n  } else if isThrottling(err) {\n    // exponential backoff retry\n  }\n}","preventionTips":["Grant ec2:DescribeNatGateways in the kops IAM policy","Don't delete NAT gateways out-of-band while kops manages them","Add backoff retry for throttling during large reconciliations"],"tags":["aws","ec2","api-error","natgateway"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}