{"record":{"id":"cd00e41f8ff8ae4a","repo":"kubernetes/kops","slug":"found-multiple-egressonlyinternetgateways-matching","errorCode":null,"errorMessage":"found multiple EgressOnlyInternetGateways matching tags","messagePattern":"found multiple EgressOnlyInternetGateways matching tags","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go","lineNumber":62,"sourceCode":"}\n\nvar _ fi.CompareWithID = (*EgressOnlyInternetGateway)(nil)\n\nfunc (e *EgressOnlyInternetGateway) CompareWithID() *string {\n\treturn e.ID\n}\n\nfunc findEgressOnlyInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2types.EgressOnlyInternetGateway, error) {\n\tresponse, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing EgressOnlyInternetGateways: %v\", err)\n\t}\n\tif response == nil || len(response.EgressOnlyInternetGateways) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.EgressOnlyInternetGateways) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple EgressOnlyInternetGateways matching tags\")\n\t}\n\tigw := response.EgressOnlyInternetGateways[0]\n\treturn &igw, nil\n}\n\nfunc (e *EgressOnlyInternetGateway) Find(c *fi.CloudupContext) (*EgressOnlyInternetGateway, error) {\n\tctx := c.Context()\n\tcloud := awsup.GetCloud(c)\n\n\trequest := &ec2.DescribeEgressOnlyInternetGatewaysInput{}\n\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\tif fi.ValueOf(e.VPC.ID) == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"VPC ID is required when EgressOnlyInternetGateway is shared\")\n\t\t}\n\n\t\trequest.Filters = []ec2types.Filter{awsup.NewEC2Filter(\"attachment.vpc-id\", *e.VPC.ID)}","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go#L44-L80","documentation":"findEgressOnlyInternetGateway found more than one Egress-Only Internet Gateway matching the task's tag filters, making it ambiguous which one kOps manages. It returns an error instead of guessing, protecting against wiring the cluster's IPv6 egress through the wrong gateway.","triggerScenarios":"DescribeEgressOnlyInternetGateways with the kOps name-tag filter returns 2+ gateways — usually from a duplicated gateway created manually or by re-running creation outside kOps, or colliding name tags across stacks.","commonSituations":"Manually creating an Egress-Only IGW with the same tag; partial cleanup after a failed cluster delete; multi-cluster environments sharing tag naming.","solutions":["List matching gateways with `aws ec2 describe-egress-only-internet-gateways` and delete or retag the duplicate","Keep the gateway whose attachments correspond to the cluster VPC; remove the stray one","Make the name tag value unique per cluster in the spec","Re-run `kops update cluster` after cleanup"],"exampleFix":"// before\naws ec2 create-egress-only-internet-gateway --tag-specifications 'ResourceType=egress-only-internet-gateway,Tags=[{Key=Name,Value=mycluster-eigw}]'  // duplicate\n// after\naws ec2 delete-egress-only-internet-gateway --egress-only-internet-gateway-id eigw-duplicate-id  // keep only one match","handlingStrategy":"validation","validationCode":"// Fail fast when tags match more than one gateway\nout, _ := ec2Client.DescribeEgressOnlyInternetGateways(ctx, &ec2.DescribeEgressOnlyInternetGatewaysInput{Filters: nameTagFilters})\nif len(out.EgressOnlyInternetGateways) > 1 {\n    return fmt.Errorf(\"%d egress-only IGWs match tag; dedupe before updating\", len(out.EgressOnlyInternetGateways))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never create Egress-Only IGWs manually with kOps' name tag","Clean up stray gateways after failed deletes","Keep IPv6 gateway tags unique per cluster","Periodically audit gateway tags across accounts"],"tags":["aws","ec2","ipv6","networking","tags"],"backgroundTag":"ambiguous-resource-name","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}