kubernetes/kops · error

AssociatedRouteTable not provided

Error message

AssociatedRouteTable not provided

What it means

For shared NAT gateways (e.Shared == true), RenderAWS requires an AssociatedRouteTable so it can tag the route table to track the shared NGW. If Shared is set but no route table is provided, it returns "AssociatedRouteTable not provided".

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:356

		return fmt.Errorf("Subnet ID not set")
	}

	// TODO: AssociatedNatgateway tag is obsolete - we can get from the route table instead
	tags := make(map[string]string)
	tags["AssociatedNatgateway"] = *id
	err = t.AddAWSTags(*e.Subnet.ID, tags)
	if err != nil {
		return fmt.Errorf("unable to tag subnet %v", err)
	}

	// If this is a shared NGW, we need to tag it
	// The tag that implies "shared" is `AssociatedNatgateway`=> NGW-ID
	// This is better than just a tag that's shared because this lets us create a whitelist of these NGWs
	// without doing a bunch more work in `kutil/delete_cluster.go`

	if fi.ValueOf(e.Shared) {
		if e.AssociatedRouteTable == nil {
			return fmt.Errorf("AssociatedRouteTable not provided")
		}
		klog.V(2).Infof("tagging route table %s to track shared NGW", fi.ValueOf(e.AssociatedRouteTable.ID))
		err = t.AddAWSTags(fi.ValueOf(e.AssociatedRouteTable.ID), tags)
		if err != nil {
			return fmt.Errorf("unable to tag route table %v", err)
		}
	}

	return nil
}

type terraformNATGateway struct {
	AllocationID *terraformWriter.Literal `cty:"allocation_id"`
	SubnetID     *terraformWriter.Literal `cty:"subnet_id"`
	Tag          map[string]string        `cty:"tags"`
}

func (_ *NatGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *NatGateway) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the AssociatedRouteTable field on the shared NatGateway task in the cluster spec to the route table that should carry the default route
2. Verify the route table reference has a resolvable ID (subsequent tagging needs it)
3. Re-run kops update after correcting the spec

Example fix

// before (spec)
natGateway: { shared: true } // no routeTable
// after
natGateway: { shared: true, associatedRouteTable: rt-12345678 }

if fi.ValueOf(nat.Shared) && nat.AssociatedRouteTable == nil {
    return fmt.Errorf("shared nat gateway requires associatedRouteTable in spec")
}

When it happens

Trigger: fi.ValueOf(e.Shared) is true during RenderAWS while e.AssociatedRouteTable == nil — i.e. a spec declares the NAT gateway as shared/reused but omits the route table reference.

Common situations: Converting a cluster to use a pre-existing NAT gateway but forgetting the associated route table; generated spec from an older kOps version missing the field; hand-edited cluster.yaml.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• ID must be set, if NatGateway is shared: %s
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w
• loading AWS config: %w
• error describing RouteTables: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/32b4d5643376abf6. Report an issue: GitHub.