kubernetes/kops · error

error listing InternetGateways: %v

Error message

error listing InternetGateways: %v

What it means

This error wraps any failure from the EC2 DescribeInternetGateways API call made while looking up an Internet Gateway in kOps' awstasks layer. It is thrown by findInternetGateway whenever AWS returns an error (auth, throttling, invalid filter/ID, network). It preserves the underlying AWS error via %v so the root cause is in the wrapped message.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:55

	ID  *string
	VPC *VPC
	// Shared is set if this is a shared InternetGateway
	Shared *bool

	// Tags is a map of aws tags that are added to the InternetGateway
	Tags map[string]string
}

var _ fi.CompareWithID = (*InternetGateway)(nil)

func (e *InternetGateway) CompareWithID() *string {
	return e.ID
}

func findInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeInternetGatewaysInput) (*ec2types.InternetGateway, error) {
	response, err := cloud.EC2().DescribeInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing InternetGateways: %v", err)
	}
	if response == nil || len(response.InternetGateways) == 0 {
		return nil, nil
	}

	if len(response.InternetGateways) != 1 {
		return nil, fmt.Errorf("found multiple InternetGateways matching tags")
	}
	igw := response.InternetGateways[0]
	return &igw, nil
}

func (e *InternetGateway) Find(c *fi.CloudupContext) (*InternetGateway, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &ec2.DescribeInternetGatewaysInput{}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error: fix the specific cause (correct igw- ID, valid VPC filter, etc.).
2. Verify IAM credentials/policy allow ec2:DescribeInternetGateways.
3. If throttling, retry with exponential backoff.
4. Check AWS region configuration matches where the VPC/IGW exists.

Example fix

// before: non-existent gateway ID in cluster spec
sharedInternetGatewayID: igw-0abcdeadbeef12345
// after: use the actual gateway ID from the shared VPC account
sharedInternetGatewayID: igw-0f1e2d3c4b5a69788

// Validate credentials and IGW ID format before calling kops
if !strings.HasPrefix(igwID, "igw-") {
    return fmt.Errorf("invalid internet gateway id %q", igwID)
}
// Ensure AWS creds resolve
_, err := config.LoadDefaultCredentials(ctx)
if err != nil {
    return fmt.Errorf("no valid AWS credentials: %w", err)
}

func hasWrappedAWSError(err error) bool {
    var awsErr smithy.APIError
    return errors.As(err, &awsErr)
}

err := kopsUpdate(...)
if err != nil && strings.Contains(err.Error(), "error listing InternetGateways") {
    var awsErr smithy.APIError
    if errors.As(err, &awsErr) && awsErr.ErrorCode() == "Throttling" {
        time.Sleep(backoff)
        // retry
    }
}

When it happens

Trigger: cloud.EC2().DescribeInternetGateways(ctx, request) returns non-nil err — e.g. invalid InternetGatewayIds, bad filter values, expired/insufficient IAM credentials, throttling, or network failure. Raised from both Find and RenderTerraform paths.

Common situations: Typo in shared IGW ID (igw-...), deleted gateway still referenced, IAM policy missing ec2:DescribeInternetGateways, AWS API throttling in large account, invalid tag filters passed by the caller.

Related errors

• error listing InternetGateway: %v
• error listing (all) InternetGateways: %v
• error creating InternetGateway: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c16442a0dfbcfad5. Report an issue: GitHub.