kubernetes/kops · error

error detaching InternetGateway %q: %v

Error message

error detaching InternetGateway %q: %v

What it means

kOps wraps failures from the EC2 DetachInternetGateway call while disassociating the IGW from its VPC before deletion. Dependency violations are returned bare so the caller retries with backoff (the VPC still references the gateway); all other errors are wrapped with the IGW ID.

Source

Thrown at pkg/resources/aws/aws.go:1037

		}
		if len(response.InternetGateways) != 1 {
			return fmt.Errorf("found multiple InternetGateways with id %q", id)
		}
		igw = &response.InternetGateways[0]
	}

	for _, a := range igw.Attachments {
		klog.V(2).Infof("Detaching EC2 InternetGateway %q", id)
		request := &ec2.DetachInternetGatewayInput{
			InternetGatewayId: &id,
			VpcId:             a.VpcId,
		}
		_, err := c.EC2().DetachInternetGateway(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			return fmt.Errorf("error detaching InternetGateway %q: %v", id, err)
		}
	}

	{
		klog.V(2).Infof("Deleting EC2 InternetGateway %q", id)
		request := &ec2.DeleteInternetGatewayInput{
			InternetGatewayId: &id,
		}
		_, err := c.EC2().DeleteInternetGateway(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			if awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound" {
				klog.Infof("Internet gateway %q not found; assuming already deleted", id)
				return nil
			}
			return fmt.Errorf("error deleting InternetGateway %q: %v", id, err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check current state: `aws ec2 describe-internet-gateways --internet-gateway-ids <id>` — if Attachment is empty it is already detached; re-run kOps delete and it will proceed to deletion
2. Retry with backoff; kOps automatically retries dependency violations until the VPC detaches
3. Confirm region correctness — the IGW must be in the region kOps is operating on
4. Verify IAM permissions for ec2:DetachInternetGateway

Example fix

// before: one-shot detach
_, err := c.EC2().DetachInternetGateway(ctx, request)
// after: tolerate already-detached
if awsup.AWSErrorCode(err) == "InvalidAttachmentID.NotFound" {
	return nil
}

// only detach if still attached
out, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{
	InternetGatewayIds: []string{id},
})
if err != nil { return err }
if len(out.InternetGateways) == 0 || len(out.InternetGateways[0].Attachments) == 0 {
	return nil // nothing to detach
}

func igwAttached(igw *ec2types.InternetGateway) bool {
	return igw != nil && len(igw.Attachments) > 0
}

_, err := c.EC2().DetachInternetGateway(ctx, request)
if err != nil {
	if awserrors.IsDependencyViolation(err) {
		return backoff.Retry(func() error { return detachAgain() }, expBackoff)
	}
	if awsup.AWSErrorCode(err) == "InvalidAttachmentID.NotFound" {
		return nil // already detached
	}
	return fmt.Errorf("error detaching InternetGateway %q: %v", id, err)
}

When it happens

Trigger: EC2 DetachInternetGateway fails with something other than a dependency violation: the attachment ID no longer exists (already detached), wrong region, throttling, or auth failure.

Common situations: The IGW was detached concurrently by another cleanup process or operator; stale kOps resource tracker holding an old attachment; throttling during parallel teardown of many clusters.

Related errors

• error attaching InternetGateway to VPC: %v
• error deleting Subnet %q: %v
• error listing subnets: %v
• error describing InternetGateway %q: %v
• found multiple InternetGateways with id %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ee017a735758ef5d. Report an issue: GitHub.