kubernetes/kops · error

error listing InternetGateway: %v

Error message

error listing InternetGateway: %v

What it means

kOps wraps failures from the EC2 DescribeInternetGateways API used to list IGWs tagged for the cluster. Any API-level failure is wrapped and aborts discovery of leftover internet gateways during cluster deletion.

Source

Thrown at pkg/resources/aws/aws.go:1112

		resourceTracker.Blocks = blocks

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func DescribeInternetGateways(cloud fi.Cloud) ([]ec2types.InternetGateway, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing EC2 InternetGateways")
	request := &ec2.DescribeInternetGatewaysInput{
		Filters: BuildEC2Filters(cloud),
	}
	response, err := c.EC2().DescribeInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing InternetGateway: %v", err)
	}

	var gateways []ec2types.InternetGateway
	gateways = append(gateways, response.InternetGateways...)

	return gateways, nil
}

// DescribeInternetGatewaysIgnoreTags returns all ec2.InternetGateways, ignoring tags
// (gateways were not always tagged in kube-up)
func DescribeInternetGatewaysIgnoreTags(cloud fi.Cloud) ([]ec2types.InternetGateway, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	klog.V(2).Infof("Listing all Internet Gateways")

	request := &ec2.DescribeInternetGatewaysInput{}
	response, err := c.EC2().DescribeInternetGateways(ctx, request)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify access with `aws ec2 describe-internet-gateways --region <region>` under the same identity
2. Refresh credentials (SSO login / new STS tokens) and re-run the delete
3. Back off and retry on throttling; the describe is read-only and safe to repeat
4. Check network/proxy reachability to the regional EC2 endpoint

// preflight: auth + EC2 reachability before listing
if _, err := sts.New(sess).GetCallerIdentity(&sts.GetCallerIdentityInput{}); err != nil {
	return fmt.Errorf("invalid AWS credentials: %w", err)
}
if _, err := ec2cli.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{MaxResults: aws.Int64(5)}); err != nil {
	return fmt.Errorf("EC2 unreachable in %s: %w", region, err)
}

var gateways []ec2types.InternetGateway
err := backoff.Retry(func() error {
	var e error
	gateways, e = aws.DescribeInternetGateways(cloud)
	if e != nil && (strings.Contains(e.Error(), "Throttling") || strings.Contains(e.Error(), "RequestLimitExceeded")) {
		return e // retryable
	}
	return backoff.Permanent(e)
}, backoff.WithMaxRetries(backoff.NewExponentialBackOff(), 5))

When it happens

Trigger: EC2 DescribeInternetGateways with BuildEC2Filters tag filters fails: expired credentials, throttling, network outage, or invalid region/endpoint.

Common situations: Long-running deletes crossing session/STS token expiry; account throttling under concurrent kOps runs; misconfigured region; corporate proxy blocking EC2 API.

Related errors

• error listing (all) InternetGateways: %v
• error listing InternetGateways: %v
• error creating InternetGateway: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/079fc764e73eed2c. Report an issue: GitHub.