kubernetes/kops · error

error finding AssociatedNatGatewayRouteTable: %v

Error message

error finding AssociatedNatGatewayRouteTable: %v

What it means

find() in the Elastic IP task attempts to locate an EIP by traversing RouteTable -> NatGateway -> ElasticIP when neither the allocation ID nor the public IP is known. This indirection calls findNatGatewayFromRouteTable on the AssociatedNatGatewayRouteTable; any failure in that lookup (AWS API error) is wrapped as this error, aborting discovery of the EIP.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/elastic_ip.go:77

func (e *ElasticIP) CompareWithID() *string {
	return e.ID
}

// Find returns the actual ElasticIP state, or nil if not found
func (e *ElasticIP) Find(c *fi.CloudupContext) (*ElasticIP, error) {
	return e.find(c.Context(), awsup.GetCloud(c))
}

// find will attempt to look up the elastic IP from AWS
func (e *ElasticIP) find(ctx context.Context, cloud awsup.AWSCloud) (*ElasticIP, error) {
	publicIP := e.PublicIP
	allocationID := e.ID

	// Find via RouteTable -> NatGateway -> ElasticIP
	if allocationID == nil && publicIP == nil && e.AssociatedNatGatewayRouteTable != nil {
		ngw, err := findNatGatewayFromRouteTable(ctx, cloud, e.AssociatedNatGatewayRouteTable)
		if err != nil {
			return nil, fmt.Errorf("error finding AssociatedNatGatewayRouteTable: %v", err)
		}

		if ngw == nil {
			klog.V(2).Infof("AssociatedNatGatewayRouteTable not found")
		} else {
			if len(ngw.NatGatewayAddresses) == 0 {
				return nil, fmt.Errorf("NatGateway %q has no addresses", *ngw.NatGatewayId)
			}
			if len(ngw.NatGatewayAddresses) > 1 {
				return nil, fmt.Errorf("NatGateway %q has multiple addresses", *ngw.NatGatewayId)
			}
			allocationID = ngw.NatGatewayAddresses[0].AllocationId
			if allocationID == nil {
				return nil, fmt.Errorf("NatGateway %q has nil addresses", *ngw.NatGatewayId)
			} else {
				klog.V(2).Infof("Found ElasticIP AllocationID %q via NatGateway", *allocationID)
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped inner error to identify the AWS API failure (access denied vs not found vs throttling).
2. Verify the route table ID exists in the region: aws ec2 describe-route-tables --route-table-ids rtb-...
3. Grant ec2:DescribeNatGateways and ec2:DescribeRouteTables to the kOps IAM role.
4. Alternatively set the EIP allocation ID (e.ID) or publicIP directly in the task so the route-table traversal is skipped entirely.
5. Retry the apply after transient AWS API issues.

Example fix

// before (EIP discovered indirectly, fails)
ngw, err := findNatGatewayFromRouteTable(ctx, cloud, e.AssociatedNatGatewayRouteTable)
// after — pin the allocation explicitly in the task to bypass discovery:
// eip := &awstasks.ElasticIP{ ID: fi.PtrTo("eipalloc-0abc123456789def0"), AssociatedNatGatewayRouteTable: rtb }
// (and fix underlying IAM/API error before retrying)

// confirm the route table and its NAT gateway exist before apply
aws ec2 describe-route-tables --route-table-ids rtb-0abc123456789def0
aws ec2 describe-nat-gateways --filter Name=route-table-id,Values=rtb-0abc123456789def0

if err := run(); err != nil {
    if strings.Contains(err.Error(), "error finding AssociatedNatGatewayRouteTable") {
        // check IAM for ec2:DescribeNatGateways / ec2:DescribeRouteTables,
        // verify the route table exists, then retry
    }
    return err
}

When it happens

Trigger: find() runs during reconciliation of an Elastic IP task with ID==nil, publicIP==nil, and AssociatedNatGatewayRouteTable set; findNatGatewayFromRouteTable's EC2 DescribeRouteTables/DescribeNatGateways calls fail (permissions, network, throttling, invalid route table ID).

Common situations: Applying a cluster where the EIP is discovered via its associated NAT gateway's route table; route table deleted or ID wrong; IAM missing ec2:DescribeNatGateways/ec2:DescribeRouteTables; transient AWS API errors or rate limiting during wide applies.

Related errors

• error describing RouteTables: %v
• error from DescribeRouteTables: %v
• error from DescribeAddresses: %v
• found %d EIP Addresses for 1 NATGateway, expected 1
• found multiple elastic IPs attached to NatGateway %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1c868df2e46245b0. Report an issue: GitHub.