{"record":{"id":"aeb6e2c3d20e68d4","repo":"kubernetes/kops","slug":"error-listing-elasticips-v","errorCode":null,"errorMessage":"error listing ElasticIPs: %v","messagePattern":"error listing ElasticIPs: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/elastic_ip.go","lineNumber":136,"sourceCode":"\t\tif len(response.Tags) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found multiple tags for: %v\", e)\n\t\t}\n\t\tt := response.Tags[0]\n\t\tpublicIP = t.Value\n\t\tklog.V(2).Infof(\"Found public IP via tag: %v\", *publicIP)\n\t}\n\n\tif publicIP != nil || allocationID != nil {\n\t\trequest := &ec2.DescribeAddressesInput{}\n\t\tif allocationID != nil {\n\t\t\trequest.AllocationIds = []string{fi.ValueOf(allocationID)}\n\t\t} else if publicIP != nil {\n\t\t\trequest.Filters = []ec2types.Filter{awsup.NewEC2Filter(\"public-ip\", *publicIP)}\n\t\t}\n\n\t\tresponse, err := cloud.EC2().DescribeAddresses(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing ElasticIPs: %v\", err)\n\t\t}\n\n\t\tif response == nil || len(response.Addresses) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"found no ElasticIPs for: %v\", e)\n\t\t}\n\n\t\tif len(response.Addresses) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found multiple ElasticIPs for: %v\", e)\n\t\t}\n\t\ta := response.Addresses[0]\n\t\tactual := &ElasticIP{\n\t\t\tID:       a.AllocationId,\n\t\t\tPublicIP: a.PublicIp,\n\t\t}\n\t\tactual.TagOnSubnet = e.TagOnSubnet\n\t\tactual.AssociatedNatGatewayRouteTable = e.AssociatedNatGatewayRouteTable\n\n\t\t{","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/elastic_ip.go#L118-L154","documentation":"During ElasticIP.find(), kOps calls EC2 DescribeAddresses (filtered by allocation ID or public-ip) to reconcile the task's declared ElasticIP with actual AWS state. If that DescribeAddresses call returns an AWS error (auth failure, malformed allocation ID, throttling, network failure), the call is wrapped as 'error listing ElasticIPs: %v'. It means the EIP lookup itself failed at the AWS API level, not that the EIP is absent.","triggerScenarios":"ec2.DescribeAddresses fails: invalid AllocationIds format (not eipalloc-*), public-ip filter with malformed IP, expired/insufficient IAM credentials, EC2 throttling, or regional endpoint unreachability during `kops update cluster` reconciliation.","commonSituations":"Stale cluster spec referencing a deleted/released EIP allocation ID in a different region; AWS credentials rotated/expired mid-run; hitting EC2 API rate limits in large clusters; corporate proxy blocking EC2 endpoints.","solutions":["Verify AWS credentials and region (aws sts get-caller-identity, check --region) and retry kops update","Check that the eipalloc-* ID / public IP in the cluster spec is well-formed and exists in the target region (aws ec2 describe-addresses)","Run `kops toolbox dump` / enable klog -v=4 to see the underlying AWS SDK error detail","If throttled, retry later or request an EC2 API rate-limit increase"],"exampleFix":"// before: stale ID in spec\nID: fi.String(\"eipalloc-deadbeef\")\n// after: correct current allocation ID from the target region\naws ec2 describe-addresses --region us-east-1 --filters Name=public-ip,Values=52.1.2.3\nID: fi.String(\"eipalloc-0abc123def4567890\")","handlingStrategy":"retry","validationCode":"id := os.Getenv(\"EIP_ALLOCATION_ID\")\nif id != \"\" && !strings.HasPrefix(id, \"eipalloc-\") {\n    return fmt.Errorf(\"invalid allocation ID %q\", id)\n}\n// pre-check API reachability\n_, err := client.DescribeAddresses(ctx, &ec2.DescribeAddressesInput{AllocationIds: []string{id}})","typeGuard":null,"tryCatchPattern":"var ae smithy.APIError\nif errors.As(err, &ae) {\n    if ae.ErrorCode() == \"ThrottlingException\" {\n        time.Sleep(backoff); // retry\n    }\n}","preventionTips":["Validate eipalloc-* IDs and IP formats in the spec before running kops update","Keep AWS credentials fresh (aws sso login / credential_process) and pin the correct --region","Add SDK retry config and backoff for EC2 throttling","Monitor CloudTrail for DescribeAddresses AccessDenied errors"],"tags":["aws","ec2","elastic-ip","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}