kubernetes/kops · error

error deleting InternetGateway %q: %v

Error message

error deleting InternetGateway %q: %v

What it means

kOps wraps failures from the EC2 DeleteInternetGateway call, the final step after detaching all attachments. NotFound is treated as already-deleted; dependency violations are returned bare for the caller's retry loop; everything else is wrapped with the gateway ID.

Source

Thrown at pkg/resources/aws/aws.go:1055

			return fmt.Errorf("error detaching InternetGateway %q: %v", id, err)
		}
	}

	{
		klog.V(2).Infof("Deleting EC2 InternetGateway %q", id)
		request := &ec2.DeleteInternetGatewayInput{
			InternetGatewayId: &id,
		}
		_, err := c.EC2().DeleteInternetGateway(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			if awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound" {
				klog.Infof("Internet gateway %q not found; assuming already deleted", id)
				return nil
			}
			return fmt.Errorf("error deleting InternetGateway %q: %v", id, err)
		}
	}

	return nil
}

func DumpInternetGateway(op *resources.DumpOperation, r *resources.Resource) error {
	data := make(map[string]interface{})
	data["id"] = r.ID
	data["type"] = r.Type
	data["raw"] = r.Obj
	op.Dump.Resources = append(op.Dump.Resources, data)
	return nil
}

func ListInternetGateways(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	gateways, err := DescribeInternetGateways(cloud)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm the IGW still exists: `aws ec2 describe-internet-gateways --internet-gateway-ids <id>`; if gone, re-run kOps delete and it will skip
2. If UnauthorizedOperation, add ec2:DeleteInternetGateway to the IAM identity
3. Wait and retry on throttling errors — kOps delete is idempotent
4. Ensure the kOps cluster region matches where the IGW actually lives

Example fix

// before
return fmt.Errorf("error deleting InternetGateway %q: %v", id, err)
// after (caller)
if strings.Contains(err.Error(), "Throttling") {
	time.Sleep(backoff)
	return retry()
}

// verify the IGW exists and is detached before deleting
out, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{
	InternetGatewayIds: []string{id},
})
if err != nil { return err }
if len(out.InternetGateways) == 0 { return nil }
if len(out.InternetGateways[0].Attachments) > 0 {
	return fmt.Errorf("IGW %s still attached; detach first", id)
}

func deletableIGW(igw *ec2types.InternetGateway) bool {
	return igw != nil && len(igw.Attachments) == 0
}

_, err := c.EC2().DeleteInternetGateway(ctx, request)
if err != nil {
	switch {
	case awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound":
		return nil
	case awserrors.IsDependencyViolation(err):
		return err // caller retries with backoff
	case strings.Contains(err.Error(), "Throttling"):
		return retryAfterBackoff()
	default:
		return fmt.Errorf("error deleting InternetGateway %q: %v", id, err)
	}
}

When it happens

Trigger: EC2 DeleteInternetGateway fails with an error other than InvalidInternetGatewayID.NotFound or a dependency violation: throttling, unauthorized operation, or wrong region/ID.

Common situations: Concurrent deletion by another operator or pipeline; IAM policy missing ec2:DeleteInternetGateway; EC2 rate limiting during large-scale teardown; deleting a cluster whose region was changed in config.

Related errors

• error deleting RouteTable %q: %v
• error deleting DhcpOptions %q: %v
• error describing InternetGateway %q: %v
• found multiple InternetGateways with id %q
• error detaching InternetGateway %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c58fedcfa95b2c6d. Report an issue: GitHub.