{"record":{"id":"a94a367fc1bb0081","repo":"kubernetes/kops","slug":"could-not-find-s-tag-from-route-table","errorCode":null,"errorMessage":"Could not find '%s' tag from route table","messagePattern":"Could not find '(.+?)' tag from route table","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":229,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"error finding associated RouteTable to NatGateway: %v\", err)\n\t\t}\n\n\t\tif rt != nil {\n\t\t\tvar natGatewayIDs []*string\n\t\t\tnatGatewayIDsSeen := map[string]bool{}\n\t\t\tfor _, route := range rt.Routes {\n\t\t\t\tif route.NatGatewayId != nil && route.State != ec2types.RouteStateBlackhole && !natGatewayIDsSeen[*route.NatGatewayId] {\n\t\t\t\t\tnatGatewayIDs = append(natGatewayIDs, route.NatGatewayId)\n\t\t\t\t\tnatGatewayIDsSeen[*route.NatGatewayId] = true\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif len(natGatewayIDs) == 0 {\n\t\t\t\tklog.V(2).Infof(\"no NatGateway found in route table %s\", *rt.RouteTableId)\n\t\t\t} else if len(natGatewayIDs) > 1 {\n\t\t\t\tclusterName, ok := routeTable.Tags[awsup.TagClusterName]\n\t\t\t\tif !ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Could not find '%s' tag from route table\", awsup.TagClusterName)\n\t\t\t\t}\n\t\t\t\tfilteredNatGateways := []*ec2types.NatGateway{}\n\t\t\t\tfor _, natGatewayID := range natGatewayIDs {\n\t\t\t\t\tgw, err := findNatGatewayById(ctx, cloud, fi.ValueOf(natGatewayID))\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, err\n\t\t\t\t\t}\n\n\t\t\t\t\tif raws.HasOwnedTag(string(ec2types.ResourceTypeNatgateway)+\":\"+fi.ValueOf(natGatewayID), gw.Tags, clusterName) {\n\t\t\t\t\t\tfilteredNatGateways = append(filteredNatGateways, gw)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif len(filteredNatGateways) == 0 {\n\t\t\t\t\tklog.V(2).Infof(\"no kOps NatGateway found in route table %s\", *rt.RouteTableId)\n\t\t\t\t} else if len(filteredNatGateways) > 1 {\n\t\t\t\t\treturn nil, fmt.Errorf(\"found multiple kOps NatGateways in route table %s\", *rt.RouteTableId)\n\t\t\t\t} else {\n\t\t\t\t\treturn filteredNatGateways[0], nil","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L211-L247","documentation":"When the private route table has more than one NAT-gateway route, kOps disambiguates by filtering gateways tagged for the cluster using the route table's TagClusterName tag. If that cluster-name tag is missing from the route table, disambiguation is impossible and this error is thrown.","triggerScenarios":"len(natGatewayIDs) > 1 (multiple nat- routes on the table) AND routeTable.Tags has no awsup.TagClusterName ('kops.k8s.io/cluster' / 'KubernetesCluster') entry — i.e. multiple NAT gateways plus a stripped/renamed cluster tag.","commonSituations":"Manual tag edits or third-party tag-enforcement tools removed KubernetesCluster from route tables; multi-cluster VPC reuse where tables were re-tagged; partial cleanup of a deleted cluster's resources reused by another.","solutions":["Re-add the cluster-name tag to the route table: `aws ec2 create-tags --resources rtb-xxx --tags Key=KubernetesCluster,Value=<cluster-name>`","Delete the duplicate nat- routes so only one 0.0.0.0/0 → nat-gateway route remains, avoiding the multi-gateway path entirely","Audit tagging policies (including AWS Tag Policies / automation) so kOps tags aren't stripped from EC2 resources"],"exampleFix":"// before: cluster tag stripped from route table\n// after: restore it\naws ec2 create-tags --resources rtb-0abc --tags Key=KubernetesCluster,Value=mycluster.example.com","handlingStrategy":"validation","validationCode":"for _, rt := range routeTables {\n  if _, ok := rt.Tags[\"KubernetesCluster\"]; !ok {\n    fmt.Printf(\"route table %s missing KubernetesCluster tag — restore it before kops update\\n\", *rt.RouteTableId)\n  }\n}","typeGuard":"func hasClusterTag(rt *RouteTable) bool {\n  _, ok := rt.Tags[awsup.TagClusterName]\n  return ok\n}","tryCatchPattern":"ngw, err := findNatGatewayFromRouteTable(ctx, cloud, rt)\nif err != nil && strings.Contains(err.Error(), \"Could not find\") {\n  // restore the cluster-name tag on the route table, then retry\n}","preventionTips":["Exclude kops.k8s.io/* and KubernetesCluster tags from tag-stripping automation","Re-apply cluster tags after VPC restructuring or multi-cluster migrations","Run periodic tag audits on route tables in managed VPCs"],"tags":["aws","ec2","tags","routetable","natgateway"],"backgroundTag":"missing-required-tag","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}