{"record":{"id":"a3ec7ea2ed0d6f3c","repo":"kubernetes/kops","slug":"vpc-id-is-required-when-internetgateway-is-shared","errorCode":null,"errorMessage":"VPC ID is required when InternetGateway is shared","messagePattern":"VPC ID is required when InternetGateway is shared","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/internetgateway.go","lineNumber":77,"sourceCode":"\t}\n\n\tif len(response.InternetGateways) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple InternetGateways matching tags\")\n\t}\n\tigw := response.InternetGateways[0]\n\treturn &igw, nil\n}\n\nfunc (e *InternetGateway) Find(c *fi.CloudupContext) (*InternetGateway, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\trequest := &ec2.DescribeInternetGatewaysInput{}\n\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\tif fi.ValueOf(e.VPC.ID) == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"VPC ID is required when InternetGateway is shared\")\n\t\t}\n\n\t\trequest.Filters = []ec2types.Filter{awsup.NewEC2Filter(\"attachment.vpc-id\", *e.VPC.ID)}\n\t} else {\n\t\tif e.ID != nil {\n\t\t\trequest.InternetGatewayIds = []string{fi.ValueOf(e.ID)}\n\t\t} else {\n\t\t\trequest.Filters = cloud.BuildFilters(e.Name)\n\t\t}\n\t}\n\n\tigw, err := findInternetGateway(ctx, cloud, request)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif igw == nil {\n\t\treturn nil, nil\n\t}","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/internetgateway.go#L59-L95","documentation":"When the InternetGateway task is marked Shared, kOps does not create a gateway — it must find an existing one by VPC ID. Find validates this up front and fails if e.VPC.ID is empty, because without a VPC ID the DescribeInternetGateways filter cannot be built.","triggerScenarios":"e.Shared is true but fi.ValueOf(e.VPC.ID) == \"\" during Find — i.e. the cluster spec declares a shared IGW without supplying the VPC ID it is attached to.","commonSituations":"Shared-VPC clusters where the user set shared: true on the IGW but left the VPC reference empty or only set it by name, malformed cluster spec after editing, templating variable that rendered empty.","solutions":["Set the VPC ID explicitly in the cluster spec (spec.networkID / shared VPC configuration).","If the VPC is shared from another account, ensure spec.networkID is populated before the task runs.","Set shared: false if kOps should manage the VPC/IGW itself."],"exampleFix":"// before\nspec:\n  networkID: \"\"\n  internetGatewayID: shared\n// after\nspec:\n  networkID: vpc-0123456789abcdef0\n  internetGatewayID: shared","handlingStrategy":"validation","validationCode":"// Check cluster spec before applying\nif shared && (cluster.Spec.NetworkID == \"\" || !strings.HasPrefix(cluster.Spec.NetworkID, \"vpc-\")) {\n    return fmt.Errorf(\"shared internet gateway requires a valid VPC ID\")\n}","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"VPC ID is required when InternetGateway is shared\") {\n    return fmt.Errorf(\"fix cluster spec: set spec.networkID to the shared VPC id\")\n}","preventionTips":["Always set spec.networkID when using a shared VPC.","Render/validate the cluster spec (kops replace --dry-run) after templating.","Avoid empty-string VPC values from Helm/CI variable substitution."],"tags":["aws","internet-gateway","validation","config"],"backgroundTag":"missing-required-argument","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}