kubernetes/kops · error

error describing RouteTables: %v

Error message

error describing RouteTables: %v

What it means

ListSubnets describes all route tables (to find NGWs tagged for shared subnets, since NGWs themselves are untagged) and returns this error for any DescribeRouteTables failure except InvalidRouteTableID.NotFound. It means route table enumeration failed, so shared NAT gateway detection cannot proceed.

Source

Thrown at pkg/resources/aws/aws.go:836

		for _, address := range response.Addresses {
			ip := aws.ToString(address.PublicIp)
			if !elasticIPs.Has(ip) {
				continue
			}
			resourceTrackers = append(resourceTrackers, buildElasticIPResource(address, ownedElasticIPs.Has(ip), clusterName))
		}
	}

	// Associated Nat Gateways
	// Note: we must not delete any shared NAT Gateways here.
	// Since we don't have tagging on the NGWs, we have to read the route tables
	if natGatewayIds.Len() != 0 {

		rtRequest := &ec2.DescribeRouteTablesInput{}
		rtResponse, err := c.EC2().DescribeRouteTables(ctx, rtRequest)
		if err != nil && awsup.AWSErrorCode(err) != "InvalidRouteTableID.NotFound" {
			return nil, fmt.Errorf("error describing RouteTables: %v", err)
		}
		// sharedNgwIds is the set of IDs for shared NGWs, that we should not delete
		sharedNgwIds := sets.NewString()
		if rtResponse != nil {
			for _, rt := range rtResponse.RouteTables {
				for _, t := range rt.Tags {
					k := aws.ToString(t.Key)
					v := aws.ToString(t.Value)

					if k == "AssociatedNatgateway" {
						sharedNgwIds.Insert(v)
					}
				}
			}
		}

		klog.V(2).Infof("Querying Nat Gateways")
		request := &ec2.DescribeNatGatewaysInput{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DescribeRouteTables in the caller's IAM policy.
2. Retry with exponential backoff on throttling errors.
3. Validate credentials and the configured region.
4. Check VPC endpoint/proxy connectivity to EC2.

perms, _ := iamSimulatePrincipalPolicy(ctx, "ec2:DescribeRouteTables")
if !perms.Allowed { return fmt.Errorf("IAM lacks ec2:DescribeRouteTables") }

func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "UnauthorizedOperation" || ae.ErrorCode() == "AccessDenied") }

if err != nil {
  if isAuthError(err) { return fmt.Errorf("grant ec2:DescribeRouteTables: %w", err) }
  if isThrottling(err) { return backoffRetry() }
  return err
}

When it happens

Trigger: ec2.DescribeRouteTables fails with anything other than InvalidRouteTableID.NotFound: UnauthorizedOperation/AuthFailure, RequestLimitExceeded throttling, invalid credentials, or network failure.

Common situations: Custom IAM policies omitting ec2:DescribeRouteTables; large multi-account setups hitting throttling; broken VPC endpoint configuration blocking EC2 API calls.

Related errors

• error from DescribeRouteTables: %v
• error describing NatGateways: %v
• error listing RouteTables: %v
• error from DescribeNatGateways: %v
• error from DescribeAddresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b62288859e8c7eaa. Report an issue: GitHub.