{"record":{"id":"b563eb8c41eb05b0","repo":"kubernetes/kops","slug":"error-creating-route-s","errorCode":null,"errorMessage":"error creating Route: %s","messagePattern":"error creating Route: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/route.go","lineNumber":231,"sourceCode":"\t\t\trequest.VpcPeeringConnectionId = e.VPCPeeringConnectionID\n\t\t}\n\n\t\tif e.Instance != nil {\n\t\t\trequest.InstanceId = checkNotNil(e.Instance.ID)\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Route with RouteTable:%q CIDR:%q IPv6CIDR:%q\",\n\t\t\taws.ToString(e.RouteTable.ID), aws.ToString(e.CIDR), aws.ToString(e.IPv6CIDR))\n\n\t\tresponse, err := t.Cloud.EC2().CreateRoute(ctx, request)\n\t\tif err != nil {\n\t\t\tcode := awsup.AWSErrorCode(err)\n\t\t\tmessage := awsup.AWSErrorMessage(err)\n\t\t\tif code == \"InvalidNatGatewayID.NotFound\" {\n\t\t\t\tklog.V(4).Infof(\"error creating Route: %s\", message)\n\t\t\t\treturn fi.NewTryAgainLaterError(\"waiting for the NAT Gateway to be created\")\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"error creating Route: %s\", message)\n\t\t}\n\n\t\tif !aws.ToBool(response.Return) {\n\t\t\treturn fmt.Errorf(\"create Route request failed: %v\", response)\n\t\t}\n\t} else {\n\t\trequest := &ec2.ReplaceRouteInput{}\n\t\trequest.RouteTableId = checkNotNil(e.RouteTable.ID)\n\n\t\tif e.CIDR != nil || e.IPv6CIDR != nil {\n\t\t\trequest.DestinationCidrBlock = e.CIDR\n\t\t\trequest.DestinationIpv6CidrBlock = e.IPv6CIDR\n\t\t} else {\n\t\t\tklog.Fatal(\"both CIDR and IPv6CIDR were unexpectedly nil\")\n\t\t}\n\n\t\tif e.InternetGateway == nil && e.NatGateway == nil && e.TransitGatewayID == nil && e.VPCPeeringConnectionID == nil {\n\t\t\treturn fmt.Errorf(\"missing target for route\")","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/route.go#L213-L249","documentation":"This error wraps a failed EC2 CreateRoute API call during Route task creation, reporting the AWS error message. Special-cased: if the error code is InvalidNatGatewayID.NotFound, kOps instead returns a retryable TryAgainLaterError, because a NAT gateway may still be propagating when the route is created. All other failures become this terminal error.","triggerScenarios":"CreateRoute failing for reasons other than NAT-gateway propagation: invalid RouteTableId or target ID, duplicate route for the destination CIDR, route table not found, or permission denied.","commonSituations":"A route already exists for the same CIDR (RouteAlreadyExists); referencing a deleted NAT/IGW/TGW; IAM missing ec2:CreateRoute; CIDR overlap with an existing route in the same table.","solutions":["Read the AWS message in the error to identify the specific API failure","If RouteAlreadyExists, remove the duplicate route from the cluster spec or delete the stale route in AWS","Verify all referenced IDs (route table, IGW, NAT, TGW) exist in the region","Check IAM permissions for ec2:CreateRoute","Re-run kops update cluster — transient propagation issues are already retried automatically"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-check that the target resource exists\naws ec2 describe-nat-gateways --nat-gateway-ids nat-0abc123 --region us-east-1\naws ec2 describe-internet-gateways --internet-gateway-ids igw-0abc123 --region us-east-1","typeGuard":null,"tryCatchPattern":"_, err := cloud.EC2().CreateRoute(ctx, req)\nif err != nil {\n\tif awsup.AWSErrorCode(err) == \"InvalidNatGatewayID.NotFound\" {\n\t\treturn fi.NewTryAgainLaterError(\"waiting for the NAT Gateway to be created\")\n\t}\n\tif awsup.AWSErrorCode(err) == \"RouteAlreadyExists\" {\n\t\t// remove the duplicate route from the spec or delete stale route\n\t}\n\treturn fmt.Errorf(\"error creating Route: %s\", awsup.AWSErrorMessage(err))\n}","preventionTips":["Avoid duplicate destination CIDRs within one route table spec","Verify all target IDs exist and are in the correct region/VPC","Ensure ec2:CreateRoute is in the kOps IAM policy","Re-run update on transient propagation errors (kOps already retries InvalidNatGatewayID.NotFound)"],"tags":["aws","ec2","route","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}