kubernetes/kops · error

error from DescribeNatGateways: %v

Error message

error from DescribeNatGateways: %v

What it means

Thrown when EC2 DescribeNatGateways fails for a specific NAT gateway ID with anything other than NatGatewayNotFound (which is treated as already-deleted). It aborts FindNatGateways during cluster resource listing.

Source

Thrown at pkg/resources/aws/aws.go:1392

						}
					}
				}
			}
		}
	}

	var resourceTrackers []*resources.Resource
	for natGatewayId := range natGatewayIds {
		request := &ec2.DescribeNatGatewaysInput{
			NatGatewayIds: []string{natGatewayId},
		}
		response, err := c.EC2().DescribeNatGateways(ctx, request)
		if err != nil {
			if awsup.AWSErrorCode(err) == "NatGatewayNotFound" {
				klog.V(2).Infof("Got NatGatewayNotFound describing NatGateway %s; will treat as already-deleted", natGatewayId)
				continue
			}
			return nil, fmt.Errorf("error from DescribeNatGateways: %v", err)
		}

		if response.NextToken != nil {
			return nil, fmt.Errorf("NextToken set from DescribeNatGateways, but pagination not implemented")
		}

		for _, ngw := range response.NatGateways {
			natGatewayId := aws.ToString(ngw.NatGatewayId)

			forceShared := !ownedNatGatewayIds.Has(natGatewayId)
			ngwResource := buildNatGatewayResource(ngw, forceShared, clusterName)
			resourceTrackers = append(resourceTrackers, ngwResource)

			// Don't try to remove ElasticIPs if NatGateway is shared
			if ngwResource.Shared {
				continue
			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the embedded error code; for throttling, retry after backoff.
2. Grant ec2:DescribeNatGateways to the IAM identity.
3. Verify NAT gateway state via `aws ec2 describe-nat-gateways --nat-gateway-ids <id>`.
4. Refresh credentials if AuthFailure/ExpiredToken.

out, err := ec2Client.DescribeNatGateways(ctx, &ec2.DescribeNatGatewaysInput{NatGatewayIds: []string{id}}); if err != nil || len(out.NatGateways) == 0 { /* treat as deleted */ }

func isNatGatewayMissing(err error) bool { code := awsup.AWSErrorCode(err); return code == "NatGatewayNotFound" || code == "InvalidNatGatewayID.NotFound" }

err := /* wrapped DescribeNatGateways error */
if isNatGatewayMissing(err) { return nil } // already deleted
return err

When it happens

Trigger: DescribeNatGateways for a single NatGatewayId returns UnauthorizedOperation, ThrottlingException, AuthFailure, or Malformed ID errors.

Common situations: NAT gateway deleted concurrently (other NotFound codes surfaces differ); IAM policy missing ec2:DescribeNatGateways; throttling during large enumerations.

Related errors

• error describing RouteTables: %v
• error describing NatGateways: %v
• error from DescribeRouteTables: %v
• error from DescribeAddresses: %v
• describing instance for arn %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a5b1ad2118fe4d78. Report an issue: GitHub.