{"record":{"id":"d5de014d886292ac","repo":"kubernetes/kops","slug":"found-multiple-routetables-attached-to-subnet","errorCode":null,"errorMessage":"found multiple RouteTables attached to subnet","messagePattern":"found multiple RouteTables attached to subnet","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/routetableassociation.go","lineNumber":143,"sourceCode":"\tif subnet.ID == nil {\n\t\treturn nil, fmt.Errorf(\"subnet ID not set\")\n\t}\n\n\tsubnetID := fi.ValueOf(subnet.ID)\n\n\trequest := &ec2.DescribeRouteTablesInput{\n\t\tFilters: []ec2types.Filter{awsup.NewEC2Filter(\"association.subnet-id\", subnetID)},\n\t}\n\tresponse, err := cloud.EC2().DescribeRouteTables(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing RouteTables for subnet %q: %v\", subnetID, err)\n\t}\n\tif response == nil || len(response.RouteTables) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.RouteTables) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple RouteTables attached to subnet\")\n\t}\n\trt := response.RouteTables[0]\n\treturn &rt, nil\n}\n\nfunc (_ *RouteTableAssociation) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *RouteTableAssociation) error {\n\tctx := context.TODO()\n\tif a == nil {\n\t\t// TODO: We might do better just to make the subnet the primary key here\n\n\t\tklog.V(2).Infof(\"Checking for existing RouteTableAssociation to subnet\")\n\t\texisting, err := findExistingRouteTableForSubnet(t.Cloud, e.Subnet)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error checking for existing RouteTableAssociation: %v\", err)\n\t\t}\n\n\t\tif existing != nil {\n\t\t\tfor _, a := range existing.Associations {","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/routetableassociation.go#L125-L161","documentation":"kOps expects exactly one route table associated with a subnet when reconciling; more than one attached route table is ambiguous (the explicit association and possibly the main route table propagated), so kOps fails rather than guessing.","triggerScenarios":"DescribeRouteTables filtered by association.subnet-id returns 2+ route tables for the same subnet during RenderAWS of a RouteTableAssociation.","commonSituations":"Operators manually associated an extra route table (e.g., a appliance/inspection route table) to a kOps-managed subnet; multiple controllers (kOps + Terraform/console) managing routing; shared-subnet setups where another team attached routes.","solutions":["List the subnet's route table associations in the AWS console/CLI and remove the unintended one: aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id>","Ensure only the kOps-managed route table is explicitly associated with the subnet","If a second table is intentional, manage associations outside the kOps RouteTableAssociation task or disable route-table management for that subnet","Re-run kops update after cleanup"],"exampleFix":"// inspect then disassociate the extra table\naws ec2 describe-route-tables --filters Name=association.subnet-id,Values=subnet-0abc\naws ec2 disassociate-route-table --association-id <extra-association-id>","handlingStrategy":"validation","validationCode":"aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id> --query 'length(RouteTables)'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not manually attach extra route tables to kOps-managed subnets","Keep one management tool (kOps) for route table associations in cluster subnets","Audit shared-VPC subnets for foreign associations before cluster updates"],"tags":["aws","route-table","subnet","conflict"],"backgroundTag":"multiple-route-tables-on-subnet","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}