kubernetes/kops · error

error describing InternetGateway %q: %v

Error message

error describing InternetGateway %q: %v

What it means

kOps wraps failures from the EC2 DescribeInternetGateways call made inside DeleteInternetGateway to fetch the gateway's attachments before detaching. NotFound is handled as already-deleted; any other describe failure is wrapped with the gateway ID.

Source

Thrown at pkg/resources/aws/aws.go:1015

func DeleteInternetGateway(cloud fi.Cloud, r *resources.Resource) error {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	id := r.ID

	var igw *ec2types.InternetGateway
	{
		request := &ec2.DescribeInternetGatewaysInput{
			InternetGatewayIds: []string{id},
		}
		response, err := c.EC2().DescribeInternetGateways(ctx, request)
		if err != nil {
			if awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound" {
				klog.Infof("Internet gateway %q not found; assuming already deleted", id)
				return nil
			}

			return fmt.Errorf("error describing InternetGateway %q: %v", id, err)
		}
		if response == nil || len(response.InternetGateways) == 0 {
			return nil
		}
		if len(response.InternetGateways) != 1 {
			return fmt.Errorf("found multiple InternetGateways with id %q", id)
		}
		igw = &response.InternetGateways[0]
	}

	for _, a := range igw.Attachments {
		klog.V(2).Infof("Detaching EC2 InternetGateway %q", id)
		request := &ec2.DetachInternetGatewayInput{
			InternetGatewayId: &id,
			VpcId:             a.VpcId,
		}
		_, err := c.EC2().DetachInternetGateway(ctx, request)
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate the IGW ID with `aws ec2 describe-internet-gateways --internet-gateway-ids <id>`; fix or remove stale references in kOps state if the ID is malformed
2. On throttling, wait and retry the kOps delete
3. Check IAM permissions for ec2:DescribeInternetGateways
4. Re-run kOps delete; missing gateways are treated as already deleted

Example fix

// before: failing on any describe error
return fmt.Errorf("error describing InternetGateway %q: %v", id, err)
// after: tolerate throttling with retry
if awsup.AWSErrorCode(err) == "Throttling" {
	time.Sleep(5 * time.Second)
	continue
}

// validate the IGW ID format before calling delete
if !strings.HasPrefix(id, "igw-") {
	return fmt.Errorf("invalid internet gateway id %q", id)
}
out, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{
	InternetGatewayIds: []string{id},
})
if err != nil { return err }
if len(out.InternetGateways) == 0 { return nil } // already deleted

func validIGWID(s string) bool {
	re := regexp.MustCompile(`^igw-[0-9a-f]{8,17}$`)
	return re.MatchString(s)
}

if err != nil {
	if awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound" {
		return nil
	}
	if strings.Contains(err.Error(), "Throttling") {
		return retryWithBackoff()
	}
	return fmt.Errorf("error describing InternetGateway %q: %v", id, err)
}

When it happens

Trigger: EC2 DescribeInternetGateways for the specific IGW ID fails with something other than InvalidInternetGatewayID.NotFound: malformed ID, throttling, auth failure, or network error.

Common situations: A hand-edited or stale resource tracker references an IGW ID that does not exist in a valid form; throttling during mass teardown; IAM missing ec2:DescribeInternetGateways.

Related errors

• found multiple InternetGateways with id %q
• error detaching InternetGateway %q: %v
• error deleting InternetGateway %q: %v
• error listing InternetGateway: %v
• error listing (all) InternetGateways: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e255d3ded6fc111e. Report an issue: GitHub.