kubernetes/kops · error

error creating ElasticIP: %v

Error message

error creating ElasticIP: %v

What it means

In ElasticIP.RenderAWS when no existing EIP is found (a == nil), kOps allocates a new VPC-domain address via AllocateAddress, optionally with tag specifications. Any error from AllocateAddress is wrapped as 'error creating ElasticIP: %v' — meaning AWS refused to allocate the new Elastic IP.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/elastic_ip.go:240

// RenderAWS is where we actually apply changes to AWS
func (_ *ElasticIP) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *ElasticIP) error {
	ctx := context.TODO()
	var publicIp *string
	var eipId *string

	// If this is a new ElasticIP
	if a == nil {
		klog.V(2).Infof("Creating ElasticIP for VPC")

		request := &ec2.AllocateAddressInput{
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeElasticIp, e.Tags),
		}
		request.Domain = ec2types.DomainTypeVpc

		response, err := t.Cloud.EC2().AllocateAddress(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating ElasticIP: %v", err)
		}

		e.ID = response.AllocationId
		e.PublicIP = response.PublicIp
		publicIp = e.PublicIP
		eipId = response.AllocationId
	} else {
		publicIp = a.PublicIP
		eipId = a.ID
		if err := t.AddAWSTags(*e.ID, e.Tags); err != nil {
			return err
		}
	}

	// Tag the associated subnet
	if e.TagOnSubnet != nil {
		if e.TagOnSubnet.ID == nil {
			return fmt.Errorf("Subnet ID not set")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check and raise the EC2 EIP limit via Service Quotas (Amazon EC2 → Elastic IP addresses) or release unused addresses: aws ec2 describe-addresses + release-address
2. Grant the kops IAM role ec2:AllocateAddress (and ec2:CreateTags / TagSpecifications support)
3. Review the underlying AWS error in the message for tag validation problems and fix the Tags in the spec
4. Retry after transient failures; confirm region quota from `kops toolbox dump` or CloudTrail

Example fix

// before: quota exceeded
error creating ElasticIP: AddressLimitExceeded
// after: release unused EIPs / raise quota, then retry
aws ec2 release-address --allocation-id eipalloc-unused
// and/or Service Quotas: request Elastic IP address limit increase

quotas, _ := sqClient.GetAWSDefaultServiceQuota(ctx, &servicequotas.GetAWSDefaultServiceQuotaInput{
    ServiceCode: aws.String("ec2"), QuotaCode: aws.String("L-0263D0A3")}) // EIP limit
used := countAddresses(ec2Client)
if used >= int(*quotas.Value) { return errors.New("EIP quota exhausted; release or request increase") }

var ae smithy.APIError
if errors.As(err, &ae) {
    if ae.ErrorCode() == "AddressLimitExceeded" {
        // release unused EIPs or request quota increase, then retry
    }
}

When it happens

Trigger: ec2.AllocateAddress fails: EIP address-pool limit reached (default 5 per region, adjustable), InvalidAddress.NotFound style pool exhaustion, IAM denial of ec2:AllocateAddress, invalid tag keys/values in TagSpecifications (e.g. 'kubernetes.io/cluster/' tags violating tag constraints), or region outage.

Common situations: New clusters in accounts that already use the 5-EIP free-tier quota (released EIPs previously hoarded); BYO account with restrictive IAM; Bringing your own VPC where tag specs collide with validation rules.

Related errors

• error describing addresses: %v
• error from DescribeAddresses: %v
• error deleting elastic ip %q: %v
• error finding AssociatedNatGatewayRouteTable: %v
• error listing ElasticIPs: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/347f60234129269f. Report an issue: GitHub.