kubernetes/kops · error

EgressOnlyInternetGateway for shared VPC was not found

Error message

EgressOnlyInternetGateway for shared VPC was not found

What it means

In RenderAWS, when a EgressOnlyInternetGateway task is marked Shared, kOps expects the gateway to already exist in AWS; it should have been located by Find() and supplied as the 'a' (actual) state. If the apply loop reaches RenderAWS with a==nil for a shared task, it means discovery found no matching Egress-Only Internet Gateway attached to the target VPC, and instead of creating one (which shared semantics forbid), kOps aborts with this error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go:146

}

func (s *EgressOnlyInternetGateway) CheckChanges(a, e, changes *EgressOnlyInternetGateway) error {
	if a != nil {
		if changes.VPC != nil {
			return fi.CannotChangeField("VPC")
		}
	}

	return nil
}

func (_ *EgressOnlyInternetGateway) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *EgressOnlyInternetGateway) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {
		// Verify the EgressOnlyInternetGateway was found and matches our required settings
		if a == nil {
			return fmt.Errorf("EgressOnlyInternetGateway for shared VPC was not found")
		}

		return nil
	}

	if a == nil {
		klog.V(2).Infof("Creating EgressOnlyInternetGateway")

		request := &ec2.CreateEgressOnlyInternetGatewayInput{
			VpcId:             e.VPC.ID,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeEgressOnlyInternetGateway, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateEgressOnlyInternetGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating EgressOnlyInternetGateway: %v", err)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Create the Egress-Only Internet Gateway manually (aws ec2 create-egress-only-internet-gateway, then attach it to the VPC) before re-running kops update.
2. Verify the VPC ID and AWS region/account in the kOps cluster spec match where the gateway actually lives.
3. Check IAM permissions allow ec2:DescribeEgressOnlyInternetGateways so discovery can find the gateway.
4. If kOps should create the gateway itself, set Shared=false.

Example fix

# before (shared gateway missing)
kops update cluster --yes
# error: EgressOnlyInternetGateway for shared VPC was not found
# after
aws ec2 create-egress-only-internet-gateway --vpc-id vpc-0abc123456789def0
kops update cluster --yes

// pre-flight AWS check before running kops update
aws ec2 describe-egress-only-internet-gateways \
  --filters Name=attachment.vpc-id,Values=vpc-0abc123456789def0 \
  --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId'

if err := target.Apply(task); err != nil {
    if strings.Contains(err.Error(), "for shared VPC was not found") {
        // create/attach the Egress-Only Internet Gateway manually, then re-apply
    }
    return err
}

When it happens

Trigger: Running kops update/apply with an EgressOnlyInternetGateway task where Shared=true and no Egress-Only Internet Gateway exists (attached to the specified VPC) in the AWS account/region — Find() returned nil, so RenderAWS receives a==nil.

Common situations: Pointing kOps at a VPC in a different region or account than the one holding the gateway; the gateway was deleted out-of-band after the spec was written; the VPC ID in the spec is wrong so the attachment.vpc-id filter matches nothing; IAM permissions prevent DescribeEgressOnlyInternetGateways from seeing the resource.

Related errors

• VPC ID is required when EgressOnlyInternetGateway is shared
• error creating EgressOnlyInternetGateway: %v
• error associating Amazon IPv6 provided CIDR block to VPC: %v
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c1974948615fad09. Report an issue: GitHub.