kubernetes/kops · error

error listing (all) InternetGateways: %v

Error message

error listing (all) InternetGateways: %v

What it means

kops wraps a failed EC2 DescribeInternetGateways call when listing all internet gateways in a region/VPC during cluster resource enumeration. The underlying AWS SDK error (auth, throttling, network, invalid filter) is embedded with %v, losing the error chain. It is thrown from DescribeInternetGatewaysIgnoreTags, invoked by ListResourcesAWS during `kops delete cluster --dry-run` style enumeration.

Source

Thrown at pkg/resources/aws/aws.go:1132

	var gateways []ec2types.InternetGateway
	gateways = append(gateways, response.InternetGateways...)

	return gateways, nil
}

// DescribeInternetGatewaysIgnoreTags returns all ec2.InternetGateways, ignoring tags
// (gateways were not always tagged in kube-up)
func DescribeInternetGatewaysIgnoreTags(cloud fi.Cloud) ([]ec2types.InternetGateway, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing all Internet Gateways")

	request := &ec2.DescribeInternetGatewaysInput{}
	response, err := c.EC2().DescribeInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing (all) InternetGateways: %v", err)
	}

	var gateways []ec2types.InternetGateway

	gateways = append(gateways, response.InternetGateways...)

	return gateways, nil
}

func DumpEgressOnlyInternetGateway(op *resources.DumpOperation, r *resources.Resource) error {
	data := make(map[string]interface{})
	data["id"] = r.ID
	data["type"] = r.Type
	data["raw"] = r.Obj
	op.Dump.Resources = append(op.Dump.Resources, data)
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws ec2 describe-internet-gateways` with the same credentials/region to reproduce and identify the underlying error.
2. Refresh credentials (aws sso login / re-export keys) and confirm AWS_REGION / cluster region match.
3. If throttled, reduce concurrent kops API calls or retry after backoff.
4. Verify network path (VPN/proxy/VPC endpoint) can reach the EC2 endpoint.

Example fix

// before
return nil, fmt.Errorf("error listing (all) InternetGateways: %v", err)
// after
return nil, fmt.Errorf("error listing (all) InternetGateways: %w", err)

sess, err := session.NewSession(); _, err = sts.New(sess).GetCallerIdentity(&sts.GetCallerIdentityInput{}); if err != nil { /* fix credentials before listing */ }

func isThrottling(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && ae.ErrorCode() == "ThrottlingException" }

gateways, err := DescribeInternetGatewaysIgnoreTags(cloud)
if err != nil {
	if isThrottling(err) { /* backoff and retry */ }
	return fmt.Errorf("internet gateway listing failed: %w", err)
}

When it happens

Trigger: EC2 DescribeInternetGateways returns any non-nil error: expired/missing credentials, ThrottlingException, network timeout, or invalid region configuration in the AWSCloud client.

Common situations: Running `kops delete cluster` with stale AWS credentials; API rate limits when scanning many clusters; VPC/endpoints blocking ec2.<region>.amazonaws.com.

Related errors

• error listing InternetGateway: %v
• error listing InternetGateways: %v
• error creating InternetGateway: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/26d23d973761cfd0. Report an issue: GitHub.