{"record":{"id":"e2380d6b2b6fc479","repo":"kubernetes/kops","slug":"found-d-nat-gateways-with-id-q-expected-1","errorCode":null,"errorMessage":"found %d Nat Gateways with ID %q, expected 1","messagePattern":"found (.+?) Nat Gateways with ID %q, expected 1","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":83,"sourceCode":"\tcloud := awsup.GetCloud(c)\n\tvar ngw *ec2types.NatGateway\n\tactual := &NatGateway{}\n\n\tif fi.ValueOf(e.ID) != \"\" {\n\t\t// We have an existing NGW, lets look up the EIP\n\t\tngwIds := []string{fi.ValueOf(e.ID)}\n\n\t\trequest := &ec2.DescribeNatGatewaysInput{\n\t\t\tNatGatewayIds: ngwIds,\n\t\t}\n\n\t\tresponse, err := cloud.EC2().DescribeNatGateways(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing Nat Gateways %v\", err)\n\t\t}\n\n\t\tif len(response.NatGateways) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found %d Nat Gateways with ID %q, expected 1\", len(response.NatGateways), fi.ValueOf(e.ID))\n\t\t}\n\t\tngw = &response.NatGateways[0]\n\n\t\tif len(ngw.NatGatewayAddresses) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found %d EIP Addresses for 1 NATGateway, expected 1\", len(ngw.NatGatewayAddresses))\n\t\t}\n\t} else {\n\t\t// This is the normal/default path\n\t\tvar err error\n\t\tngw, err = e.findNatGateway(c)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif ngw == nil {\n\t\t\treturn nil, nil\n\t\t}\n\t}\n","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L65-L101","documentation":"After describing a NAT gateway by ID, Find() requires exactly one result; this error fires when the ID matched zero or multiple gateways. Since DescribeNatGateways filters by a specific ID, 0 results means the gateway was deleted, and >1 is an AWS-side invariant violation; either way kOps cannot map the stored ID to current state.","triggerScenarios":"e.ID is set but the NAT gateway no longer exists (deleted out-of-band or in another region/account), yielding 0 results; >1 is theoretically impossible with an ID filter but is defensively checked.","commonSituations":"NAT gateway manually deleted in console during a maintenance window; kOps state pointing at an old cluster's gateway; region misconfiguration making the ID unresolvable.","solutions":["Confirm the gateway ID exists: aws ec2 describe-nat-gateways --nat-gateway-ids ngw-xxx","If deleted intentionally, run kops update cluster to recreate it (clear stale ID from state)","Check you are operating in the correct region and account","If 0 results after deletion, recreate via kops rather than restoring manually to keep state consistent"],"exampleFix":"// before: gateway deleted manually, kops still references it\n// after\nkops update cluster --name mycluster.k8s.local --yes  # recreates NAT gateway and fixes state","handlingStrategy":"validation","validationCode":"out, _ := cloud.EC2().DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{id}})\nif out == nil || len(out.NatGateways) == 0 {\n  return errors.New(\"referenced NAT gateway no longer exists; run kops update cluster to recreate\")\n}","typeGuard":null,"tryCatchPattern":"if len(response.NatGateways) != 1 {\n  return fmt.Errorf(\"stale NAT gateway ID %s: found %d, expected 1 — recreate via kops update\", id, len(response.NatGateways))\n}","preventionTips":["Never delete kOps-managed NAT gateways manually; use kops delete cluster","Verify region/account before operations","Reconcile state after out-of-band changes"],"tags":["aws","ec2","nat-gateway","state-inconsistency"],"backgroundTag":"resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}