kubernetes/kops · error

error listing RouteTables: %v

Error message

error listing RouteTables: %v

What it means

DescribeRouteTables in pkg/resources/aws/routetable.go calls EC2 DescribeRouteTables once per filter set built by buildEC2FiltersForCluster (owned and shared cluster tags) and wraps any API error with this message. It means the route-table inventory for the cluster failed, typically during `kops delete cluster` discovery.

Source

Thrown at pkg/resources/aws/routetable.go:46

	"k8s.io/kops/pkg/resources"
	"k8s.io/kops/upup/pkg/fi"
	"k8s.io/kops/upup/pkg/fi/cloudup/awsup"
)

// DescribeRouteTables lists route-tables tagged for the cluster (shared and owned)
func DescribeRouteTables(cloud fi.Cloud, clusterName string) (map[string]ec2types.RouteTable, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	routeTables := make(map[string]ec2types.RouteTable)
	klog.V(2).Info("Listing EC2 RouteTables")
	for _, filters := range buildEC2FiltersForCluster(clusterName) {
		request := &ec2.DescribeRouteTablesInput{
			Filters: filters,
		}
		response, err := c.EC2().DescribeRouteTables(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing RouteTables: %v", err)
		}

		for _, rt := range response.RouteTables {
			routeTables[aws.ToString(rt.RouteTableId)] = rt
		}
	}

	return routeTables, nil
}

func ListRouteTables(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	routeTables, err := DescribeRouteTables(cloud, clusterName)
	if err != nil {
		return nil, err
	}

	var resourceTrackers []*resources.Resource

View on GitHub (pinned to 4c8573c808)

Solutions

1. Confirm IAM policy includes ec2:DescribeRouteTables for the account/region.
2. Check AWS credentials and that the AWSCloud client region matches the cluster's region.
3. Handle throttling: retry with exponential backoff, or stagger parallel resource listing.
4. Verify network path to EC2 endpoint (VPC endpoints, proxy, DNS).

Example fix

// before
return nil, fmt.Errorf("error listing RouteTables: %v", err)
// after
var opErr *smithy.OperationError
if errors.As(err, &opErr) && strings.Contains(err.Error(), "RequestLimitExceeded") {
    return nil, fmt.Errorf("error listing RouteTables (throttled, retry later): %w", err)
}
return nil, fmt.Errorf("error listing RouteTables: %w", err)

// preflight: verify describe access
_, err := ec2Client.DescribeRouteTables(ctx, &ec2.DescribeRouteTablesInput{MaxResults: aws.Int32(1)})
if err != nil {
    return fmt.Errorf("ec2:DescribeRouteTables preflight failed: %w", err)
}

func isThrottling(err error) bool {
    return err != nil && (strings.Contains(err.Error(), "RequestLimitExceeded") || strings.Contains(err.Error(), "Throttling"))
}

routeTables, err := DescribeRouteTables(cloud, clusterName)
if err != nil {
    if isThrottling(err) {
        time.Sleep(backoff); routeTables, err = DescribeRouteTables(cloud, clusterName)
    }
    if err != nil { return fmt.Errorf("route table discovery aborted: %w", err) }
}

When it happens

Trigger: ec2.DescribeRouteTables returning an error for any of the cluster-tag filter sets: UnauthorizedOperation (no ec2:DescribeRouteTables permission), InvalidFilter errors, throttling (RequestLimitExceeded), InvalidClientTokenId from bad credentials, or connectivity failures.

Common situations: Read-only IAM profiles missing ec2:DescribeRouteTables; running kops from a network-isolated host or behind a proxy; heavy concurrent deletion hitting EC2 rate limits; wrong-region client (credentials valid elsewhere) causing auth errors.

Related errors

• error listing SecurityGroups: %v
• error describing SecurityGroup rules %q: %v
• error adding AWS Tags to EBS Volume: %v
• Unable to tag subnet %v
• error creating InternetGateway: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bedf78c5f1d8ea64. Report an issue: GitHub.