kubernetes/kops · error

error deleting elastic ip %q: %v

Error message

error deleting elastic ip %q: %v

What it means

DeleteElasticIP wraps a failed EC2 ReleaseAddress call for an EIP, formatted with the resource name. Dependency-violation errors (e.g. the EIP is still attached) are returned unwrapped for the tracker to retry; everything else becomes this wrapped error.

Source

Thrown at pkg/resources/aws/aws.go:1746

	c := cloud.(awsup.AWSCloud)

	id := t.ID

	klog.V(2).Infof("Releasing IP %s", t.Name)
	request := &ec2.ReleaseAddressInput{
		AllocationId: &id,
	}
	_, err := c.EC2().ReleaseAddress(ctx, request)
	if err != nil {
		if awsup.AWSErrorCode(err) == "InvalidAllocationID.NotFound" {
			klog.V(2).Infof("Got InvalidAllocationID.NotFound error deleting ElasticIP %q; will treat as already-deleted", id)
			return nil
		}

		if IsDependencyViolation(err) {
			return err
		}
		return fmt.Errorf("error deleting elastic ip %q: %v", t.Name, err)
	}
	return nil
}

func DeleteNatGateway(cloud fi.Cloud, t *resources.Resource) error {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	id := t.ID

	klog.V(2).Infof("Removing NatGateway %s", t.Name)
	request := &ec2.DeleteNatGatewayInput{
		NatGatewayId: &id,
	}
	_, err := c.EC2().DeleteNatGateway(ctx, request)
	if err != nil {
		if IsDependencyViolation(err) {
			return err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry after the associated NAT gateway/instance is deleted — dependency violations are retried by the tracker automatically.
2. Verify the allocation ID still exists (aws ec2 describe-addresses); if already released, the next pass will converge.
3. Add ec2:ReleaseAddress to the IAM policy.
4. Check the wrapped %v for the exact AWS error (InvalidAllocationID.NotFound, AuthFailure, etc.).
5. Wait for AWS to finish async NAT gateway deletion before forcing EIP cleanup.

addrs, err := c.EC2().DescribeAddresses(ctx, &ec2.DescribeAddressesInput{AllocationIds: []string{*t.ID}})
if err != nil || len(addrs.Addresses) == 0 { /* already released; skip */ }
if len(addrs.Addresses[0].AssociationId) > 0 { /* still associated; disassociate or wait for NGW deletion */ }

if err := DeleteElasticIP(cloud, r); err != nil {
    if awsup.AWSErrorCode(err) == "InvalidAllocationID.NotFound" { return nil // already gone }
    return err // tracker will retry dependency violations
}

When it happens

Trigger: ReleaseAddress fails: the EIP is still associated with a NAT gateway or instance (dependency violation path handles that separately), AuthFailure for invalid allocation ID, AccessDenied on ec2:ReleaseAddress, or the EIP was already released by another process.

Common situations: Deleting a cluster where the NAT gateway deletion hasn't completed before EIP release; EIP manually released via console while kOps was tearing down; missing ec2:ReleaseAddress IAM permission.

Related errors

• error terminating instances: %v
• error describing addresses: %v
• error deleting KeyPair %q: %v
• error deleting EgressOnlyInternetGateway %q: %v
• error from DescribeAddresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/91e1d75e26c7ed02. Report an issue: GitHub.