kubernetes/kops · error

cannot route IPv4 to an EgressOnlyInternetGateway

Error message

cannot route IPv4 to an EgressOnlyInternetGateway

What it means

This error is raised when a Route task specifies an EgressOnlyInternetGateway as its target but also sets an IPv4 CIDR destination. Egress-only internet gateways are IPv6-only constructs; they cannot be used for IPv4 traffic, so AWS (and kOps) reject the combination.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/route.go:149

}

func (s *Route) CheckChanges(a, e, changes *Route) error {
	if a == nil {
		// TODO: Create validate method?
		if e.RouteTable == nil {
			return fi.RequiredField("RouteTable")
		}
		if e.CIDR == nil && e.IPv6CIDR == nil {
			return fi.RequiredField("CIDR/IPv6CIDR")
		}
		if e.CIDR != nil && e.IPv6CIDR != nil {
			return fmt.Errorf("cannot set more than one CIDR or IPv6CIDR")
		}
		targetCount := 0
		if e.EgressOnlyInternetGateway != nil {
			targetCount++
			if e.CIDR != nil {
				return fmt.Errorf("cannot route IPv4 to an EgressOnlyInternetGateway")
			}
		}
		if e.InternetGateway != nil {
			targetCount++
		}
		if e.Instance != nil {
			targetCount++
		}
		if e.NatGateway != nil {
			targetCount++
		}
		if e.TransitGatewayID != nil {
			targetCount++
		}
		if e.VPCPeeringConnectionID != nil {
			targetCount++
		}
		if targetCount == 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Change the route destination from CIDR (IPv4) to IPv6CIDR (e.g. ::/0)
2. Replace the target with a regular InternetGateway if IPv4 egress is actually needed
3. Remove the EgressOnlyInternetGateway field entirely if unintended

Example fix

// before
route:
  cidr: 0.0.0.0/0
  egressOnlyInternetGateway: eigw-123
// after
route:
  ipv6Cidr: ::/0
  egressOnlyInternetGateway: eigw-123

func validateEgressOnlyRoute(r Route) error {
	if r.EgressOnlyInternetGateway != nil {
		if r.CIDR != nil {
			return errors.New("cannot route IPv4 to an EgressOnlyInternetGateway")
		}
		if r.IPv6CIDR == nil {
			return errors.New("egress-only routes require ipv6Cidr")
		}
	}
	return nil
}

When it happens

Trigger: Setting `egressOnlyInternetGateway` on a route whose destination is an IPv4 `cidr` instead of an `ipv6Cidr`.

Common situations: Misconfiguring an IPv6 egress route by using an IPv4 CIDR copied from an internet-gateway route; confusion between regular IGW and egress-only IGW semantics.

Related errors

• cannot set more than one CIDR or IPv6CIDR
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v
• error deleting EgressOnlyInternetGateway %q: %v
• error listing EgressOnlyInternetGateway: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4a1f81670ea15d99. Report an issue: GitHub.