{"record":{"id":"d259722950c4e33c","repo":"kubernetes/kops","slug":"nat-gateway-q-not-found","errorCode":null,"errorMessage":"NAT gateway %q not found","messagePattern":"NAT gateway %q not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":309,"sourceCode":"\t\t\treturn fi.CannotChangeField(\"ID\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (e *NatGateway) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *NatGateway) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *NatGateway) error {\n\t// New NGW\n\tctx := context.TODO()\n\n\tvar id *string\n\tif a == nil {\n\n\t\tif fi.ValueOf(e.Shared) {\n\t\t\treturn fmt.Errorf(\"NAT gateway %q not found\", fi.ValueOf(e.ID))\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Nat Gateway\")\n\n\t\trequest := &ec2.CreateNatGatewayInput{\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeNatgateway, e.Tags),\n\t\t}\n\t\trequest.AllocationId = e.ElasticIP.ID\n\t\trequest.SubnetId = e.Subnet.ID\n\t\tresponse, err := t.Cloud.EC2().CreateNatGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error creating Nat Gateway: %v\", err)\n\t\t}\n\t\te.ID = response.NatGateway.NatGatewayId\n\t\tid = e.ID\n\t} else {\n\t\tid = a.ID\n\t}","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L291-L327","documentation":"During RenderAWS, when the NatGateway task is new (a == nil) but e.Shared is true, kOps expects the gateway to already exist under a user-supplied ID. If no ID is set (or lookup produced none), it cannot create a shared resource itself and fails.","triggerScenarios":"NatGateway task with shared: true whose ID is empty/nil — e.g. cluster spec uses a shared/external NAT gateway but `id` wasn't provided in the instance group/subnet spec.","commonSituations":"Users wiring pre-existing AWS infrastructure into kops (shared VPC) who forget to specify the NAT gateway ID for the subnet; typos in the spec field so the ID never populates.","solutions":["Set the NAT gateway ID in the cluster spec for shared subnets: `kops edit cluster` → subnet spec `id: nat-xxxx`","Remove `shared: true` from the NAT gateway/subnet spec so kops creates and manages the gateway itself","Verify the referenced gateway exists in the target region with `aws ec2 describe-nat-gateways --nat-gateway-ids nat-xxxx`"],"exampleFix":"// before\nsubnets:\n- name: private-a\n  type: Private\n  shared: true\n// after\nsubnets:\n- name: private-a\n  type: Private\n  shared: true\n  id: nat-0123456789abcdef0","handlingStrategy":"validation","validationCode":"// in cluster spec tooling, before update:\nif subnet.Shared && subnet.NatGatewayID == \"\" {\n  return fmt.Errorf(\"shared subnet %q requires an explicit NAT gateway id\", subnet.Name)\n}","typeGuard":"func sharedNatGatewayIDSet(e *NatGateway) bool {\n  return !fi.ValueOf(e.Shared) || fi.ValueOf(e.ID) != \"\"\n}","tryCatchPattern":"err := applyCluster(ctx)\nif err != nil && strings.Contains(err.Error(), \"NAT gateway\") && strings.Contains(err.Error(), \"not found\") {\n  // set the id: field on the shared subnet spec or drop shared:true\n}","preventionTips":["Always set `id:` for shared subnets in the cluster spec","Validate the referenced NAT gateway exists via awscli before `kops update`","Use `kops edit cluster` rather than hand-editing raw manifests to keep schema intact"],"tags":["aws","natgateway","configuration","shared-resource"],"backgroundTag":"shared-resource-id-missing","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}