kubernetes/kops · error

error creating EgressOnlyInternetGateway: %v

Error message

error creating EgressOnlyInternetGateway: %v

What it means

RenderAWS creates a new Egress-Only Internet Gateway via EC2 CreateEgressOnlyInternetGateway for non-shared tasks. If that AWS API call fails (network, permissions, invalid VPC ID, throttling), the underlying SDK error is wrapped with this message and propagated up through the kOps apply loop, aborting cluster reconciliation.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go:162

		// Verify the EgressOnlyInternetGateway was found and matches our required settings
		if a == nil {
			return fmt.Errorf("EgressOnlyInternetGateway for shared VPC was not found")
		}

		return nil
	}

	if a == nil {
		klog.V(2).Infof("Creating EgressOnlyInternetGateway")

		request := &ec2.CreateEgressOnlyInternetGatewayInput{
			VpcId:             e.VPC.ID,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeEgressOnlyInternetGateway, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateEgressOnlyInternetGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating EgressOnlyInternetGateway: %v", err)
		}

		e.ID = response.EgressOnlyInternetGateway.EgressOnlyInternetGatewayId
		return nil
	}

	return t.UpdateTags(*e.ID, e.Tags)
}

type terraformEgressOnlyInternetGateway struct {
	VPCID *terraformWriter.Literal `cty:"vpc_id"`
	Tags  map[string]string        `cty:"tags"`
}

func (_ *EgressOnlyInternetGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *EgressOnlyInternetGateway) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS SDK error to identify the root cause (invalid VPC ID vs access denied vs throttling).
2. Verify the VPC ID exists in the target region: aws ec2 describe-vpcs --vpc-ids vpc-...
3. Grant the kOps IAM role ec2:CreateEgressOnlyInternetGateway (and related attach/tag permissions).
4. Retry after transient throttling/outage; kops update is generally idempotent.
5. Check AWS service health / network connectivity to EC2 endpoints (especially in air-gapped or proxy setups).

Example fix

// before
return fmt.Errorf("error creating EgressOnlyInternetGateway: %v", err)
// after — fix the underlying cause, e.g. ensure the VPC exists in the region:
// aws ec2 describe-vpcs --region us-east-1 --vpc-ids $VPC_ID
// then re-run: kops update cluster --yes

// verify preconditions before apply
aws ec2 describe-vpcs --vpc-ids vpc-0abc123456789def0
aws iam simulate-principal-policy --policy-source-arn $KOPS_ROLE_ARN \
  --action-names ec2:CreateEgressOnlyInternetGateway

if err := applyErr(); err != nil {
    var apiErr smithy.APIError
    if errors.As(err, &apiErr) {
        switch apiErr.ErrorCode() {
        case "InvalidVpcID.NotFound":
            // fix VPC ID in spec
        case "AccessDenied":
            // fix IAM policy
        case "Throttling", "RequestLimitExceeded":
            // back off and retry
        }
    }
    return err
}

When it happens

Trigger: kops update/apply with Shared=false and no existing gateway: t.Cloud.EC2().CreateEgressOnlyInternetGateway returns an error — e.g. InvalidVpcID.NotFound, AccessDenied, throttling, or connectivity failure.

Common situations: Typo in VPC ID in the cluster spec; IAM role lacking ec2:CreateEgressOnlyInternetGateway; region misconfiguration pointing kOps at a VPC from another region; AWS API throttling or transient outages during large applies.

Related errors

• error listing subnets: %v
• error listing EgressOnlyInternetGateway: %v
• VPC ID is required when EgressOnlyInternetGateway is shared
• EgressOnlyInternetGateway for shared VPC was not found
• error creating VPCDHCPOptionsAssociation: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aa28a0860b068b54. Report an issue: GitHub.