kubernetes/kops · error

error listing EgressOnlyInternetGateway: %v

Error message

error listing EgressOnlyInternetGateway: %v

What it means

kops wraps a failed EC2 DescribeEgressOnlyInternetGateways call when enumerating IPv6 egress-only internet gateways for a VPC. Any SDK error (auth, throttling, invalid filter) becomes this wrapped message and aborts listing of egress-only gateways during resource discovery.

Source

Thrown at pkg/resources/aws/aws.go:1221

		resourceTracker.Blocks = blocks

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func DescribeEgressOnlyInternetGateways(cloud fi.Cloud) ([]ec2types.EgressOnlyInternetGateway, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing EC2 EgressOnlyInternetGateways")
	request := &ec2.DescribeEgressOnlyInternetGatewaysInput{
		Filters: BuildEC2Filters(cloud),
	}
	response, err := c.EC2().DescribeEgressOnlyInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing EgressOnlyInternetGateway: %v", err)
	}

	var gateways []ec2types.EgressOnlyInternetGateway
	gateways = append(gateways, response.EgressOnlyInternetGateways...)

	return gateways, nil
}

func DeleteAutoScalingGroup(cloud fi.Cloud, r *resources.Resource) error {
	ctx := context.TODO()

	c := cloud.(awsup.AWSCloud)

	id := r.ID

	klog.V(2).Infof("Deleting autoscaling group %q", id)
	request := &autoscaling.DeleteAutoScalingGroupInput{
		AutoScalingGroupName: &id,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws ec2 describe-egress-only-internet-gateways` with the same credentials to surface the raw error.
2. Add ec2:DescribeEgressOnlyInternetGateways to the IAM policy.
3. Refresh expired credentials and confirm region.
4. Retry later if the embedded code is Throttling/RequestLimitExceeded.

if _, err := sts.New(sess).GetCallerIdentity(&sts.GetCallerIdentityInput{}); err != nil { return fmt.Errorf("credentials invalid: %w", err) }

func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "AuthFailure" || ae.ErrorCode() == "UnauthorizedOperation") }

gateways, err := DescribeEgressOnlyInternetGateways(cloud)
if err != nil {
	if isAuthError(err) { return fmt.Errorf("check IAM/credentials: %w", err) }
	return err
}

When it happens

Trigger: DescribeEgressOnlyInternetGateways call with BuildEC2Filters fails: missing ec2:DescribeEgressOnlyInternetGateways permission, throttling, or credentials expired.

Common situations: Cluster teardown listing phase fails on IPv6-enabled clusters; IAM read-only policy missing the egress-only IGW describe action; regional API outage.

Related errors

• error creating EgressOnlyInternetGateway: %v
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/9d0e7d1c15639420. Report an issue: GitHub.