{"record":{"id":"7915da10efd7d74f","repo":"kubernetes/kops","slug":"error-finding-associated-routetable-to-natgateway","errorCode":null,"errorMessage":"error finding associated RouteTable to NatGateway: %v","messagePattern":"error finding associated RouteTable to NatGateway: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":211,"sourceCode":"\t}\n\n\tif response == nil || len(response.NatGateways) == 0 {\n\t\tklog.V(2).Infof(\"Unable to find NatGateway %q\", id)\n\t\treturn nil, nil\n\t}\n\tif len(response.NatGateways) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple NatGateways with id %q\", id)\n\t}\n\treturn &response.NatGateways[0], nil\n}\n\nfunc findNatGatewayFromRouteTable(ctx context.Context, cloud awsup.AWSCloud, routeTable *RouteTable) (*ec2types.NatGateway, error) {\n\t// Find via route on private route table\n\tif routeTable.ID != nil {\n\t\tklog.V(2).Infof(\"trying to match NatGateway via RouteTable %s\", *routeTable.ID)\n\t\trt, err := findRouteTableByID(ctx, cloud, *routeTable.ID)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error finding associated RouteTable to NatGateway: %v\", err)\n\t\t}\n\n\t\tif rt != nil {\n\t\t\tvar natGatewayIDs []*string\n\t\t\tnatGatewayIDsSeen := map[string]bool{}\n\t\t\tfor _, route := range rt.Routes {\n\t\t\t\tif route.NatGatewayId != nil && route.State != ec2types.RouteStateBlackhole && !natGatewayIDsSeen[*route.NatGatewayId] {\n\t\t\t\t\tnatGatewayIDs = append(natGatewayIDs, route.NatGatewayId)\n\t\t\t\t\tnatGatewayIDsSeen[*route.NatGatewayId] = true\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif len(natGatewayIDs) == 0 {\n\t\t\t\tklog.V(2).Infof(\"no NatGateway found in route table %s\", *rt.RouteTableId)\n\t\t\t} else if len(natGatewayIDs) > 1 {\n\t\t\t\tclusterName, ok := routeTable.Tags[awsup.TagClusterName]\n\t\t\t\tif !ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Could not find '%s' tag from route table\", awsup.TagClusterName)","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L193-L229","documentation":"findNatGatewayFromRouteTable locates the NAT gateway via the default route (0.0.0.0/0 target nat-...) on the private route table. This error wraps a failure to fetch that route table with findRouteTableByID, aborting the NatGateway Find flow.","triggerScenarios":"findRouteTableByID(ctx, cloud, *routeTable.ID) returns err — DescribeRouteTables API failure (AccessDenied, throttling, invalid route table ID, network error) while reconciling a private RouteTable task.","commonSituations":"Route table deleted out-of-band leaving stale IDs in kops state; IAM missing ec2:DescribeRouteTables; transient AWS API errors during `kops update cluster --reconverge` or `kops get cluster` with cloud lookups.","solutions":["Inspect the wrapped %v cause (AccessDenied vs NotFound vs throttling) and address accordingly","Verify the route table ID still exists with `aws ec2 describe-route-tables --route-table-ids <id>`; recreate/retag if deleted out-of-band","Ensure the kops controller/CLI IAM policy grants ec2:DescribeRouteTables","Retry on transient/throttling errors"],"exampleFix":"// before: IAM lacking describe access → error\n// after: attach required permission\n{\"Effect\":\"Allow\",\"Action\":[\"ec2:DescribeRouteTables\",\"ec2:DescribeNatGateways\"],\"Resource\":\"*\"}","handlingStrategy":"try-catch","validationCode":"_, err := ec2Client.DescribeRouteTables(ctx, &ec2.DescribeRouteTablesInput{RouteTableIds: []string{rtbID}})\nif err != nil { return fmt.Errorf(\"route table %s unreachable: %w\", rtbID, err) }","typeGuard":"func routeTableExists(ctx context.Context, c awsup.AWSCloud, id string) bool {\n  out, err := findRouteTableByID(ctx, c, id)\n  return err == nil && out != nil\n}","tryCatchPattern":"ngw, err := findNatGatewayFromRouteTable(ctx, cloud, rt)\nif err != nil {\n  if isThrottling(err) { /* backoff and retry */ }\n  if strings.Contains(err.Error(), \"InvalidRouteTableID.NotFound\") { /* stale table — resync kops state */ }\n}","preventionTips":["Keep ec2:DescribeRouteTables in the IAM policy","Don't delete route tables managed by kops out-of-band","Back off on throttling when reconciling many route tables"],"tags":["aws","ec2","routetable","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}