kubernetes/kops · error

error from DescribeRouteTables: %v

Error message

error from DescribeRouteTables: %v

What it means

Thrown when EC2 DescribeRouteTables fails (for any code other than InvalidRouteTableID.NotFound) while FindNatGateways resolves which route tables point at NAT gateways. The NotFound code is tolerated because the table may already be deleted; all other failures abort resource enumeration.

Source

Thrown at pkg/resources/aws/aws.go:1348

func FindNatGateways(cloud fi.Cloud, routeTables map[string]*resources.Resource, clusterName string) ([]*resources.Resource, error) {
	if len(routeTables) == 0 {
		return nil, nil
	}

	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	natGatewayIds := sets.NewString()
	ownedNatGatewayIds := sets.NewString()
	{
		request := &ec2.DescribeRouteTablesInput{}
		for _, routeTable := range routeTables {
			request.RouteTableIds = append(request.RouteTableIds, routeTable.ID)
		}
		response, err := c.EC2().DescribeRouteTables(ctx, request)
		if err != nil && awsup.AWSErrorCode(err) != "InvalidRouteTableID.NotFound" {
			return nil, fmt.Errorf("error from DescribeRouteTables: %v", err)
		}
		if response != nil {
			for _, rt := range response.RouteTables {
				routeTableID := aws.ToString(rt.RouteTableId)
				resource := routeTables[routeTableID]
				if resource == nil {
					// We somehow got a route table that we didn't ask for
					klog.Warningf("unable to find resource for route table %s", routeTableID)
					continue
				}

				shared := resource.Shared
				for _, t := range rt.Tags {
					k := *t.Key
					// v := *t.Value
					if k == "AssociatedNatgateway" {
						shared = true
					}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the embedded AWS error code and act: UnauthorizedOperation → fix IAM (ec2:DescribeRouteTables).
2. If a route table vanished concurrently, re-run kops delete cluster --dry-run; the NotFound path is already handled.
3. Retry on throttling with backoff.
4. Verify region/credentials if AuthFailure.

ids := make([]string, 0, len(routeTables)); for _, rt := range routeTables { if strings.HasPrefix(rt.ID, "rtb-") { ids = append(ids, rt.ID) } }

func isNotFoundCode(err error) bool { return awsup.AWSErrorCode(err) == "InvalidRouteTableID.NotFound" }

_, err := FindNatGateways(cloud, vpcID, clusterName)
if err != nil {
	var ae smithy.APIError
	if errors.As(err, &ae) && ae.ErrorCode() == "InvalidRouteTableID.NotFound" { return nil }
	return err
}

When it happens

Trigger: DescribeRouteTables with a batch of route table IDs fails: one ID invalid in an unexpected way, UnauthorizedOperation, throttling, or AuthFailure.

Common situations: Route tables deleted between listing and describing (race during concurrent teardown); IAM missing ec2:DescribeRouteTables; region mismatch.

Related errors

• error describing RouteTables: %v
• error describing NatGateways: %v
• error listing RouteTables: %v
• error from DescribeNatGateways: %v
• error from DescribeAddresses: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a1318c6e18fd3586. Report an issue: GitHub.