kubernetes/kops · error

error disassociating existing RouteTable from subnet: %v

Error message

error disassociating existing RouteTable from subnet: %v

What it means

DisassociateRouteTable failed while removing the subnet's pre-existing route table association before creating the new RouteTableAssociation; a subnet may have only one association, so the old one must be removed first. The wrapped error is the raw EC2 API response.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/routetableassociation.go:172

		klog.V(2).Infof("Checking for existing RouteTableAssociation to subnet")
		existing, err := findExistingRouteTableForSubnet(t.Cloud, e.Subnet)
		if err != nil {
			return fmt.Errorf("error checking for existing RouteTableAssociation: %v", err)
		}

		if existing != nil {
			for _, a := range existing.Associations {
				if aws.ToString(a.SubnetId) != aws.ToString(e.Subnet.ID) {
					continue
				}
				klog.V(2).Infof("Creating RouteTableAssociation")
				request := &ec2.DisassociateRouteTableInput{
					AssociationId: a.RouteTableAssociationId,
				}

				_, err := t.Cloud.EC2().DisassociateRouteTable(ctx, request)
				if err != nil {
					return fmt.Errorf("error disassociating existing RouteTable from subnet: %v", err)
				}
			}
		}

		klog.V(2).Infof("Creating RouteTableAssociation")
		request := &ec2.AssociateRouteTableInput{
			SubnetId:     e.Subnet.ID,
			RouteTableId: e.RouteTable.ID,
		}

		response, err := t.Cloud.EC2().AssociateRouteTable(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating RouteTableAssociation: %v", err)
		}

		e.ID = response.AssociationId
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause: InvalidAssociationID.NotFound means it vanished — just re-run kops update
2. Add ec2:DisassociateRouteTable to the IAM policy if UnauthorizedOperation
3. Avoid concurrent kops update runs against the same cluster
4. If throttled, re-run later or reduce concurrent API load

Example fix

{"Effect":"Allow","Action":["ec2:DisassociateRouteTable","ec2:AssociateRouteTable"],"Resource":"*"}

aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id>  # ensure consistent state before apply

// InvalidAssociationID.NotFound is safe to ignore: re-run kops update
for attempts := 0; attempts < 3; attempts++ {
  if err := kopsUpdate(); err == nil || !strings.Contains(err.Error(), "RequestLimitExceeded") { break }
  time.Sleep(30 * time.Second)
}

When it happens

Trigger: During RenderAWS, kOps finds an existing association bound to a different route table and calls DisassociateRouteTable, which fails: UnauthorizedOperation, association already gone (InvalidAssociationID.NotFound), throttling, or dependency (e.g., route table in use by another operation).

Common situations: IAM role lacking ec2:DisassociateRouteTable; concurrent kOps runs racing on the same subnet; stale state where the association was deleted out-of-band between list and disassociate.

Related errors

• error describing RouteTables: %v
• error listing RouteTables: %v
• error from DescribeRouteTables: %v
• error listing RouteTables: %v
• error listing RouteTables for subnet %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/769a11e8453c8182. Report an issue: GitHub.