kubernetes/kops · error

Error creating Nat Gateway: %v

Error message

Error creating Nat Gateway: %v

What it means

The EC2 CreateNatGateway API call failed during RenderAWS, so the new NAT gateway could not be provisioned. The AWS error is wrapped verbatim; common AWS causes are no free Elastic IP allocation, subnet issues, or throttling.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:321

	ctx := context.TODO()

	var id *string
	if a == nil {

		if fi.ValueOf(e.Shared) {
			return fmt.Errorf("NAT gateway %q not found", fi.ValueOf(e.ID))
		}

		klog.V(2).Infof("Creating Nat Gateway")

		request := &ec2.CreateNatGatewayInput{
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeNatgateway, e.Tags),
		}
		request.AllocationId = e.ElasticIP.ID
		request.SubnetId = e.Subnet.ID
		response, err := t.Cloud.EC2().CreateNatGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("Error creating Nat Gateway: %v", err)
		}
		e.ID = response.NatGateway.NatGatewayId
		id = e.ID
	} else {
		id = a.ID
	}

	err := t.AddAWSTags(*e.ID, e.Tags)
	if err != nil {
		return fmt.Errorf("unable to tag NatGateway")
	}

	// Tag the associated subnet
	if e.Subnet == nil {
		return fmt.Errorf("Subnet not set")
	} else if e.Subnet.ID == nil {
		return fmt.Errorf("Subnet ID not set")
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS cause: for InsufficientFreeAddressesInSubnet, enlarge the subnet CIDR or free up IPs
2. For rate limiting, wait ~30s+ and re-run `kops update cluster` (kops will retry creation)
3. Verify the ElasticIP allocation exists in the same region and subnet ID is correct
4. Ensure IAM allows ec2:CreateNatGateway and ec2:CreateTags

Example fix

// before: too-small private subnet
# cluster spec: cidr: 172.20.1.0/28  (no free IPs)
// after
# cluster spec: cidr: 172.20.1.0/24

subnet, err := ec2Client.DescribeSubnets(ctx, &ec2.DescribeSubnetsInput{SubnetIds: []string{subnetID}})
// check free address count
availIPs := *subnet.Subnets[0].AvailableIpAddressCount
if availIPs < 8 { return fmt.Errorf("subnet %s has only %d free IPs", subnetID, availIPs) }

err := applyCluster(ctx)
var aerr smithy.APIError
if errors.As(err, &aerr) {
  switch aerr.ErrorCode() {
  case "InsufficientFreeAddressesInSubnet": // enlarge subnet CIDR
  case "Throttling", "LimitExceededException": // backoff, NATGW creation is rate-limited per subnet
  case "InvalidSubnetID.NotFound": // fix subnet id / region
  }
}

When it happens

Trigger: t.Cloud.EC2().CreateNatGateway returns err — InsufficientFreeAddressesInSubnet, ElasticIP allocation problems, InvalidSubnetID.NotFound, CreateNatGateway rate limit (one per subnet per ~30s), or AccessDenied.

Common situations: Private subnet exhausted its free IPs; creating many private subnets at once (AWS throttles NAT gateway creation per subnet); ElasticIP task referenced an allocation in the wrong region; IAM missing ec2:CreateNatGateway.

Related errors

• error creating ElasticIP: %v
• found multiple tags for: %v
• error listing NatGateway %q: %v
• found multiple NatGateways with id %q
• Could not find '%s' tag from route table

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/40b49cfe3781839f. Report an issue: GitHub.