kubernetes/kops · error

error listing EgressOnlyInternetGateways: %v

Error message

error listing EgressOnlyInternetGateways: %v

What it means

The shared helper findEgressOnlyInternetGateway wraps any EC2 DescribeEgressOnlyInternetGateways failure in this error. Callers (Find and RenderTerraform) rely on it to discover the existing gateway; a failure stops reconciliation/output generation. The wrapped AWS error contains the actual cause.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go:55

	ID  *string
	VPC *VPC
	// Shared is set if this is a shared EgressOnlyInternetGateway
	Shared *bool

	// Tags is a map of aws tags that are added to the EgressOnlyInternetGateway
	Tags map[string]string
}

var _ fi.CompareWithID = (*EgressOnlyInternetGateway)(nil)

func (e *EgressOnlyInternetGateway) CompareWithID() *string {
	return e.ID
}

func findEgressOnlyInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2types.EgressOnlyInternetGateway, error) {
	response, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing EgressOnlyInternetGateways: %v", err)
	}
	if response == nil || len(response.EgressOnlyInternetGateways) == 0 {
		return nil, nil
	}

	if len(response.EgressOnlyInternetGateways) != 1 {
		return nil, fmt.Errorf("found multiple EgressOnlyInternetGateways matching tags")
	}
	igw := response.EgressOnlyInternetGateways[0]
	return &igw, nil
}

func (e *EgressOnlyInternetGateway) Find(c *fi.CloudupContext) (*EgressOnlyInternetGateway, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &ec2.DescribeEgressOnlyInternetGatewaysInput{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant ec2:DescribeEgressOnlyInternetGateways in the IAM policy
2. Check the wrapped error for throttling and retry with backoff
3. Verify AWS credentials and region configuration
4. Retry `kops update cluster` after transient API issues

_, err := iamSimulate(iamClient, roleArn, "ec2:DescribeEgressOnlyInternetGateways")
if err != nil { return fmt.Errorf("IAM missing permission: %w", err) }

resp, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)
if err != nil {
    var terr *ec2types.ThrottlingException
    if errors.As(err, &terr) { /* retry with backoff */ }
    return fmt.Errorf("error listing EgressOnlyInternetGateways: %w", err)
}

When it happens

Trigger: DescribeEgressOnlyInternetGateways API call errors — missing ec2:DescribeEgressOnlyInternetGateways permission, invalid filter, throttling, or credential/connectivity failure.

Common situations: Overly restrictive IAM for IPv6 clusters; API throttling on large accounts; stale or expired AWS credentials.

Related errors

• found multiple EgressOnlyInternetGateways matching tags
• failed to assign prefix: %w
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v
• cannot determine challenge endpoint for instance id: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c9296a3b2d8be7e7. Report an issue: GitHub.