kubernetes/kops · error

error creating RouteTableAssociation: %v

Error message

error creating RouteTableAssociation: %v

What it means

AssociateRouteTable failed while binding the subnet to the target route table — commonly an invalid or already-deleted RouteTableId/SubnetId, or missing ec2:AssociateRouteTable permission. The AWS API detail is in the wrapped error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/routetableassociation.go:185

					AssociationId: a.RouteTableAssociationId,
				}

				_, err := t.Cloud.EC2().DisassociateRouteTable(ctx, request)
				if err != nil {
					return fmt.Errorf("error disassociating existing RouteTable from subnet: %v", err)
				}
			}
		}

		klog.V(2).Infof("Creating RouteTableAssociation")
		request := &ec2.AssociateRouteTableInput{
			SubnetId:     e.Subnet.ID,
			RouteTableId: e.RouteTable.ID,
		}

		response, err := t.Cloud.EC2().AssociateRouteTable(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating RouteTableAssociation: %v", err)
		}

		e.ID = response.AssociationId
	}

	return nil // no tags
}

type terraformRouteTableAssociation struct {
	SubnetID     *terraformWriter.Literal `cty:"subnet_id"`
	RouteTableID *terraformWriter.Literal `cty:"route_table_id"`
}

func (_ *RouteTableAssociation) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *RouteTableAssociation) error {
	tf := &terraformRouteTableAssociation{
		SubnetID:     e.Subnet.TerraformLink(),
		RouteTableID: e.RouteTable.TerraformLink(),
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error: InvalidSubnetID.NotFound/InvalidRouteTableID.NotFound means resources were deleted — re-create or fix the cluster spec
2. Verify route table and subnet are in the same VPC and region
3. Add ec2:AssociateRouteTable to the IAM role if UnauthorizedOperation
4. Re-run kops update after fixing

aws ec2 describe-subnets --subnet-ids <subnet-id>
aws ec2 describe-route-tables --route-table-ids <rt-id>  # confirm both exist and share the VPC

if err != nil {
  switch {
  case strings.Contains(err.Error(), "InvalidSubnetID.NotFound"), strings.Contains(err.Error(), "InvalidRouteTableID.NotFound"):
    // resource deleted out-of-band: recreate / fix spec
  case strings.Contains(err.Error(), "UnauthorizedOperation"):
    // fix IAM policy
  }
}

When it happens

Trigger: AssociateRouteTable fails with invalid subnet/route table IDs (resources deleted out-of-band), UnauthorizedOperation, InvalidParameterValue (wrong region/VPC), or throttling during RenderAWS.

Common situations: Subnet or route table deleted manually between planning and apply; IAM policy missing ec2:AssociateRouteTable; cross-VPC mismatch where the route table belongs to a different VPC than the subnet; region misconfiguration.

Related errors

• error describing RouteTables: %v
• error listing RouteTables: %v
• error from DescribeRouteTables: %v
• error listing RouteTables: %v
• error listing RouteTables for subnet %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9ea1872663d8b49d. Report an issue: GitHub.