kubernetes/kops · error

error listing RouteTables for subnet %q: %v

Error message

error listing RouteTables for subnet %q: %v

What it means

Wraps an AWS EC2 API failure from DescribeRouteTables while looking up the route table attached to a subnet. kOps propagates the underlying SDK error with context so the developer knows which subnet lookup failed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/routetableassociation.go:136

}

func findExistingRouteTableForSubnet(cloud awsup.AWSCloud, subnet *Subnet) (*ec2types.RouteTable, error) {
	ctx := context.TODO()
	if subnet == nil {
		return nil, fmt.Errorf("subnet not set")
	}
	if subnet.ID == nil {
		return nil, fmt.Errorf("subnet ID not set")
	}

	subnetID := fi.ValueOf(subnet.ID)

	request := &ec2.DescribeRouteTablesInput{
		Filters: []ec2types.Filter{awsup.NewEC2Filter("association.subnet-id", subnetID)},
	}
	response, err := cloud.EC2().DescribeRouteTables(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing RouteTables for subnet %q: %v", subnetID, err)
	}
	if response == nil || len(response.RouteTables) == 0 {
		return nil, nil
	}

	if len(response.RouteTables) != 1 {
		return nil, fmt.Errorf("found multiple RouteTables attached to subnet")
	}
	rt := response.RouteTables[0]
	return &rt, nil
}

func (_ *RouteTableAssociation) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *RouteTableAssociation) error {
	ctx := context.TODO()
	if a == nil {
		// TODO: We might do better just to make the subnet the primary key here

		klog.V(2).Infof("Checking for existing RouteTableAssociation to subnet")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v cause in the message to identify the AWS error code
2. If throttled, reduce API pressure or re-run; kOps has backoff but large clusters may need splitting
3. Verify IAM policy of the node/master role includes ec2:DescribeRouteTables
4. Check VPC endpoint / network connectivity to EC2 in the target region

Example fix

// IAM policy: ensure this statement exists
{"Effect":"Allow","Action":["ec2:DescribeRouteTables"],"Resource":"*"}

// preflight API check
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=<subnet-id> --region <region>

if err := applyCluster(); err != nil {
  var ae smithy.APIError
  if errors.As(err, &ae) && ae.ErrorCode() == "ThrottlingException" {
    time.Sleep(backoff); retry()
  }
}

When it happens

Trigger: EC2 DescribeRouteTables call fails: throttling (RequestLimitExceeded), credentials/permission errors (UnauthorizedOperation, AccessDenied), network timeouts, or API outage — during RenderAWS of a RouteTableAssociation.

Common situations: Accounts hitting EC2 rate limits on large clusters; IAM policies missing ec2:DescribeRouteTables for the kOps/instance role; corporate proxy or VPC endpoint issues breaking AWS SDK calls.

Related errors

• error describing RouteTables: %v
• error listing RouteTables: %v
• error from DescribeRouteTables: %v
• error listing RouteTables: %v
• error disassociating existing RouteTable from subnet: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/42f529089af7e157. Report an issue: GitHub.