kubernetes/kops · error

error describing NatGateways: %v

Error message

error describing NatGateways: %v

What it means

ListSubnets calls ec2:DescribeNatGateways to enumerate NAT gateways and wraps any failure in this error. It means NAT gateway discovery failed, preventing detection of which subnets' NGWs are shared and should not be deleted. The raw AWS error is embedded via %v.

Source

Thrown at pkg/resources/aws/aws.go:857

		sharedNgwIds := sets.NewString()
		if rtResponse != nil {
			for _, rt := range rtResponse.RouteTables {
				for _, t := range rt.Tags {
					k := aws.ToString(t.Key)
					v := aws.ToString(t.Value)

					if k == "AssociatedNatgateway" {
						sharedNgwIds.Insert(v)
					}
				}
			}
		}

		klog.V(2).Infof("Querying Nat Gateways")
		request := &ec2.DescribeNatGatewaysInput{}
		response, err := c.EC2().DescribeNatGateways(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error describing NatGateways: %v", err)
		}

		for _, ngw := range response.NatGateways {
			id := aws.ToString(ngw.NatGatewayId)
			if !natGatewayIds.Has(id) {
				continue
			}

			forceShared := sharedNgwIds.Has(id) || !ownedNatGatewayIds.Has(id)
			r := buildNatGatewayResource(ngw, forceShared, clusterName)
			resourceTrackers = append(resourceTrackers, r)
		}
	}

	return resourceTrackers, nil
}

func DescribeSubnets(cloud fi.Cloud) ([]ec2types.Subnet, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add ec2:DescribeNatGateways to the IAM policy.
2. Retry with backoff if throttled (RequestLimitExceeded/ThrottlingException).
3. Verify credentials and region are correct for the cluster.
4. Check AWS service health / endpoint connectivity if persistent.

if _, err := ec2Client.DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{"probe"}}); isAuthError(err) { return fmt.Errorf("IAM lacks ec2:DescribeNatGateways: %w", err) }

func isThrottling(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "RequestLimitExceeded" || ae.ErrorCode() == "ThrottlingException") }

if err != nil {
  if isThrottling(err) { return retryWithBackoff(op, 5) }
  if isAuthError(err) { return fmt.Errorf("grant ec2:DescribeNatGateways: %w", err) }
  return err
}

When it happens

Trigger: ec2.DescribeNatGateways fails: UnauthorizedOperation (missing ec2:DescribeNatGateways), RequestLimitExceeded throttling, invalid credentials, transient API/network failure, or calling it in a region/account without NGW support enabled.

Common situations: IAM policies granting EC2 read permissions selectively but omitting NAT gateway APIs; throttling in accounts with many VPCs; kops version/regional endpoint issues.

Related errors

• error describing RouteTables: %v
• error from DescribeRouteTables: %v
• error from DescribeNatGateways: %v
• error from DescribeAddresses: %v
• describing instance for arn %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5fddb28635d4078e. Report an issue: GitHub.