{"record":{"id":"769a11e8453c8182","repo":"kubernetes/kops","slug":"error-disassociating-existing-routetable-from-subn","errorCode":null,"errorMessage":"error disassociating existing RouteTable from subnet: %v","messagePattern":"error disassociating existing RouteTable from subnet: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/routetableassociation.go","lineNumber":172,"sourceCode":"\t\tklog.V(2).Infof(\"Checking for existing RouteTableAssociation to subnet\")\n\t\texisting, err := findExistingRouteTableForSubnet(t.Cloud, e.Subnet)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error checking for existing RouteTableAssociation: %v\", err)\n\t\t}\n\n\t\tif existing != nil {\n\t\t\tfor _, a := range existing.Associations {\n\t\t\t\tif aws.ToString(a.SubnetId) != aws.ToString(e.Subnet.ID) {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tklog.V(2).Infof(\"Creating RouteTableAssociation\")\n\t\t\t\trequest := &ec2.DisassociateRouteTableInput{\n\t\t\t\t\tAssociationId: a.RouteTableAssociationId,\n\t\t\t\t}\n\n\t\t\t\t_, err := t.Cloud.EC2().DisassociateRouteTable(ctx, request)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"error disassociating existing RouteTable from subnet: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating RouteTableAssociation\")\n\t\trequest := &ec2.AssociateRouteTableInput{\n\t\t\tSubnetId:     e.Subnet.ID,\n\t\t\tRouteTableId: e.RouteTable.ID,\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().AssociateRouteTable(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating RouteTableAssociation: %v\", err)\n\t\t}\n\n\t\te.ID = response.AssociationId\n\t}\n","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/routetableassociation.go#L154-L190","documentation":"DisassociateRouteTable failed while removing the subnet's pre-existing route table association before creating the new RouteTableAssociation; a subnet may have only one association, so the old one must be removed first. The wrapped error is the raw EC2 API response.","triggerScenarios":"During RenderAWS, kOps finds an existing association bound to a different route table and calls DisassociateRouteTable, which fails: UnauthorizedOperation, association already gone (InvalidAssociationID.NotFound), throttling, or dependency (e.g., route table in use by another operation).","commonSituations":"IAM role lacking ec2:DisassociateRouteTable; concurrent kOps runs racing on the same subnet; stale state where the association was deleted out-of-band between list and disassociate.","solutions":["Read the wrapped cause: InvalidAssociationID.NotFound means it vanished — just re-run kops update","Add ec2:DisassociateRouteTable to the IAM policy if UnauthorizedOperation","Avoid concurrent kops update runs against the same cluster","If throttled, re-run later or reduce concurrent API load"],"exampleFix":"{\"Effect\":\"Allow\",\"Action\":[\"ec2:DisassociateRouteTable\",\"ec2:AssociateRouteTable\"],\"Resource\":\"*\"}","handlingStrategy":"retry","validationCode":"aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id>  # ensure consistent state before apply","typeGuard":null,"tryCatchPattern":"// InvalidAssociationID.NotFound is safe to ignore: re-run kops update\nfor attempts := 0; attempts < 3; attempts++ {\n  if err := kopsUpdate(); err == nil || !strings.Contains(err.Error(), \"RequestLimitExceeded\") { break }\n  time.Sleep(30 * time.Second)\n}","preventionTips":["Don't run concurrent kops updates on the same cluster","Grant ec2:AssociateRouteTable and ec2:DisassociateRouteTable in IAM","Re-run on transient AWS failures; reconciliation is idempotent"],"tags":["aws","ec2","route-table","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}