{"record":{"id":"ab7b70618c06b14d","repo":"kubernetes/kops","slug":"found-d-eip-addresses-for-1-natgateway-expected","errorCode":null,"errorMessage":"found %d EIP Addresses for 1 NATGateway, expected 1","messagePattern":"found (.+?) EIP Addresses for 1 NATGateway, expected 1","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":88,"sourceCode":"\t\t// We have an existing NGW, lets look up the EIP\n\t\tngwIds := []string{fi.ValueOf(e.ID)}\n\n\t\trequest := &ec2.DescribeNatGatewaysInput{\n\t\t\tNatGatewayIds: ngwIds,\n\t\t}\n\n\t\tresponse, err := cloud.EC2().DescribeNatGateways(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing Nat Gateways %v\", err)\n\t\t}\n\n\t\tif len(response.NatGateways) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found %d Nat Gateways with ID %q, expected 1\", len(response.NatGateways), fi.ValueOf(e.ID))\n\t\t}\n\t\tngw = &response.NatGateways[0]\n\n\t\tif len(ngw.NatGatewayAddresses) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found %d EIP Addresses for 1 NATGateway, expected 1\", len(ngw.NatGatewayAddresses))\n\t\t}\n\t} else {\n\t\t// This is the normal/default path\n\t\tvar err error\n\t\tngw, err = e.findNatGateway(c)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif ngw == nil {\n\t\t\treturn nil, nil\n\t\t}\n\t}\n\n\tactual.ID = ngw.NatGatewayId\n\n\tactual.Subnet = e.Subnet\n\tif len(ngw.NatGatewayAddresses) == 0 {\n\t\t// Not sure if this ever happens","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L70-L106","documentation":"When a NAT gateway is found, Find() validates it has exactly one network interface address/EIP; this error fires when the gateway reports multiple addresses. kOps models a NAT gateway with a single Elastic IP, so a multi-address gateway cannot be represented in the task's actual state.","triggerScenarios":"ngw.NatGatewayAddresses has length >1 — typically a NAT gateway whose EIP was manually reassociated, or gateways mutated by external tooling adding secondary addresses.","commonSituations":"Manual EIP association/disassociation via console during IP reshuffling; automation reassigning EIPs; corrupted/merged gateways after failed migrations.","solutions":["Inspect addresses: aws ec2 describe-nat-gateways --nat-gateway-ids ngw-xxx --query 'NatGateways[].NatGatewayAddresses'","Disassociate the extra EIP so only one remains, then re-run kops (kops edit may reconcile)","If manual repair is impractical, delete and let kOps recreate the NAT gateway","Audit external automation so it does not attach additional addresses"],"exampleFix":"// before: two EIPs attached\naws ec2 disassociate-address --association-id eipassoc-extra\n// after: only the original allocation remains; re-run kops update cluster","handlingStrategy":"validation","validationCode":"if len(ngw.NatGatewayAddresses) != 1 {\n  return fmt.Errorf(\"NAT gateway %s must have exactly one EIP, has %d\", id, len(ngw.NatGatewayAddresses))\n}","typeGuard":null,"tryCatchPattern":"if err := findErr; err != nil && strings.Contains(err.Error(), \"EIP Addresses\") {\n  // disassociate extra EIPs then re-run reconcile\n}","preventionTips":["Don't attach secondary EIPs to kOps-managed NAT gateways","Freeze external IP-management automation on cluster subnets","Audit EIP associations after manual maintenance"],"tags":["aws","ec2","nat-gateway","elastic-ip"],"backgroundTag":"multiple-elastic-ips","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}