{"record":{"id":"c1974948615fad09","repo":"kubernetes/kops","slug":"egressonlyinternetgateway-for-shared-vpc-was-not-f","errorCode":null,"errorMessage":"EgressOnlyInternetGateway for shared VPC was not found","messagePattern":"EgressOnlyInternetGateway for shared VPC was not found","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go","lineNumber":146,"sourceCode":"}\n\nfunc (s *EgressOnlyInternetGateway) CheckChanges(a, e, changes *EgressOnlyInternetGateway) error {\n\tif a != nil {\n\t\tif changes.VPC != nil {\n\t\t\treturn fi.CannotChangeField(\"VPC\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *EgressOnlyInternetGateway) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *EgressOnlyInternetGateway) error {\n\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Verify the EgressOnlyInternetGateway was found and matches our required settings\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"EgressOnlyInternetGateway for shared VPC was not found\")\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating EgressOnlyInternetGateway\")\n\n\t\trequest := &ec2.CreateEgressOnlyInternetGatewayInput{\n\t\t\tVpcId:             e.VPC.ID,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeEgressOnlyInternetGateway, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateEgressOnlyInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating EgressOnlyInternetGateway: %v\", err)\n\t\t}\n","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go#L128-L164","documentation":"In RenderAWS, when a EgressOnlyInternetGateway task is marked Shared, kOps expects the gateway to already exist in AWS; it should have been located by Find() and supplied as the 'a' (actual) state. If the apply loop reaches RenderAWS with a==nil for a shared task, it means discovery found no matching Egress-Only Internet Gateway attached to the target VPC, and instead of creating one (which shared semantics forbid), kOps aborts with this error.","triggerScenarios":"Running kops update/apply with an EgressOnlyInternetGateway task where Shared=true and no Egress-Only Internet Gateway exists (attached to the specified VPC) in the AWS account/region — Find() returned nil, so RenderAWS receives a==nil.","commonSituations":"Pointing kOps at a VPC in a different region or account than the one holding the gateway; the gateway was deleted out-of-band after the spec was written; the VPC ID in the spec is wrong so the attachment.vpc-id filter matches nothing; IAM permissions prevent DescribeEgressOnlyInternetGateways from seeing the resource.","solutions":["Create the Egress-Only Internet Gateway manually (aws ec2 create-egress-only-internet-gateway, then attach it to the VPC) before re-running kops update.","Verify the VPC ID and AWS region/account in the kOps cluster spec match where the gateway actually lives.","Check IAM permissions allow ec2:DescribeEgressOnlyInternetGateways so discovery can find the gateway.","If kOps should create the gateway itself, set Shared=false."],"exampleFix":"# before (shared gateway missing)\nkops update cluster --yes\n# error: EgressOnlyInternetGateway for shared VPC was not found\n# after\naws ec2 create-egress-only-internet-gateway --vpc-id vpc-0abc123456789def0\nkops update cluster --yes","handlingStrategy":"validation","validationCode":"// pre-flight AWS check before running kops update\naws ec2 describe-egress-only-internet-gateways \\\n  --filters Name=attachment.vpc-id,Values=vpc-0abc123456789def0 \\\n  --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId'","typeGuard":null,"tryCatchPattern":"if err := target.Apply(task); err != nil {\n    if strings.Contains(err.Error(), \"for shared VPC was not found\") {\n        // create/attach the Egress-Only Internet Gateway manually, then re-apply\n    }\n    return err\n}","preventionTips":["Create the shared Egress-Only Internet Gateway before applying the kOps manifest.","Confirm region, account, and VPC ID in the spec match the real gateway.","Audit IAM for ec2:DescribeEgressOnlyInternetGateways so discovery works.","Re-check shared resources after out-of-band deletions (drift detection)."],"tags":["aws","ec2","vpc","ipv6","shared-resource"],"backgroundTag":"shared-resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}