{"record":{"id":"f4c6dae7a2ccb3ec","repo":"kubernetes/kops","slug":"internetgateway-for-shared-vpc-was-not-found","errorCode":null,"errorMessage":"InternetGateway for shared VPC was not found","messagePattern":"InternetGateway for shared VPC was not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/internetgateway.go","lineNumber":147,"sourceCode":"\nfunc (s *InternetGateway) CheckChanges(a, e, changes *InternetGateway) error {\n\tif a != nil {\n\t\t// TODO: I think we can change it; we just detach & attach\n\t\tif changes.VPC != nil {\n\t\t\treturn fi.CannotChangeField(\"VPC\")\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (_ *InternetGateway) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *InternetGateway) error {\n\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Verify the InternetGateway was found and matches our required settings\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"InternetGateway for shared VPC was not found\")\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating InternetGateway\")\n\n\t\trequest := &ec2.CreateInternetGatewayInput{\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeInternetGateway, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating InternetGateway: %v\", err)\n\t\t}\n\n\t\te.ID = response.InternetGateway.InternetGatewayId","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/internetgateway.go#L129-L165","documentation":"RenderAWS checks that when the InternetGateway is shared, the Find pass actually located a matching gateway (a != nil). If the existing/shared gateway could not be found, AWS-side application fails with this error instead of attempting creation (which would be wrong for a shared resource).","triggerScenarios":"e.Shared is true and a == nil, i.e. the DescribeInternetGateways lookup by attachment.vpc-id found zero matching gateways — the referenced VPC has no attached IGW, or the wrong VPC ID was given.","commonSituations":"Shared VPC that genuinely has no internet gateway attached, typo'd vpc- ID pointing at a different VPC, gateway detached after cluster creation, cross-account shared VPC where the lookup ran in the wrong account/region.","solutions":["Attach an Internet Gateway to the shared VPC (or ask the VPC owner to).","Verify spec.networkID points at the correct VPC in the correct region/account.","Remove shared/internetGatewayID settings if kOps should create the IGW itself."],"exampleFix":"// before: VPC without IGW, cluster says internetGatewayID: shared\n// after: attach one first\naws ec2 create-internet-gateway\naws ec2 attach-internet-gateway --internet-gateway-id igw-0123 --vpc-id vpc-0123456789abcdef0","handlingStrategy":"validation","validationCode":"aws ec2 describe-internet-gateways \\\n  --filters Name=attachment.vpc-id,Values=<vpc-id> \\\n  --query 'length(InternetGateways)'   # must be >= 1 in the target region/account","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"InternetGateway for shared VPC was not found\") {\n    return fmt.Errorf(\"attach an IGW to VPC %s or unset shared mode before retrying\", vpcID)\n}","preventionTips":["Verify IGW attachment in the shared VPC before pointing kops at it.","Confirm account ID and region of the shared VPC.","Do not mark shared unless the VPC owner guarantees an attached IGW."],"tags":["aws","internet-gateway","shared-vpc","not-found"],"backgroundTag":"resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}