{"record":{"id":"c9296a3b2d8be7e7","repo":"kubernetes/kops","slug":"error-listing-egressonlyinternetgateways-v","errorCode":null,"errorMessage":"error listing EgressOnlyInternetGateways: %v","messagePattern":"error listing EgressOnlyInternetGateways: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go","lineNumber":55,"sourceCode":"\tID  *string\n\tVPC *VPC\n\t// Shared is set if this is a shared EgressOnlyInternetGateway\n\tShared *bool\n\n\t// Tags is a map of aws tags that are added to the EgressOnlyInternetGateway\n\tTags map[string]string\n}\n\nvar _ fi.CompareWithID = (*EgressOnlyInternetGateway)(nil)\n\nfunc (e *EgressOnlyInternetGateway) CompareWithID() *string {\n\treturn e.ID\n}\n\nfunc findEgressOnlyInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2types.EgressOnlyInternetGateway, error) {\n\tresponse, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing EgressOnlyInternetGateways: %v\", err)\n\t}\n\tif response == nil || len(response.EgressOnlyInternetGateways) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.EgressOnlyInternetGateways) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple EgressOnlyInternetGateways matching tags\")\n\t}\n\tigw := response.EgressOnlyInternetGateways[0]\n\treturn &igw, nil\n}\n\nfunc (e *EgressOnlyInternetGateway) Find(c *fi.CloudupContext) (*EgressOnlyInternetGateway, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\trequest := &ec2.DescribeEgressOnlyInternetGatewaysInput{}\n","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go#L37-L73","documentation":"The shared helper findEgressOnlyInternetGateway wraps any EC2 DescribeEgressOnlyInternetGateways failure in this error. Callers (Find and RenderTerraform) rely on it to discover the existing gateway; a failure stops reconciliation/output generation. The wrapped AWS error contains the actual cause.","triggerScenarios":"DescribeEgressOnlyInternetGateways API call errors — missing ec2:DescribeEgressOnlyInternetGateways permission, invalid filter, throttling, or credential/connectivity failure.","commonSituations":"Overly restrictive IAM for IPv6 clusters; API throttling on large accounts; stale or expired AWS credentials.","solutions":["Grant ec2:DescribeEgressOnlyInternetGateways in the IAM policy","Check the wrapped error for throttling and retry with backoff","Verify AWS credentials and region configuration","Retry `kops update cluster` after transient API issues"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"_, err := iamSimulate(iamClient, roleArn, \"ec2:DescribeEgressOnlyInternetGateways\")\nif err != nil { return fmt.Errorf(\"IAM missing permission: %w\", err) }","typeGuard":null,"tryCatchPattern":"resp, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)\nif err != nil {\n    var terr *ec2types.ThrottlingException\n    if errors.As(err, &terr) { /* retry with backoff */ }\n    return fmt.Errorf(\"error listing EgressOnlyInternetGateways: %w\", err)\n}","preventionTips":["Add ec2:DescribeEgressOnlyInternetGateways to IAM policy","Use exponential backoff on throttling errors","Verify credentials/region before updates"],"tags":["aws","ec2","ipv6","networking"],"backgroundTag":"describe-egress-gateway-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}