kubernetes/kops · error

error listing VPCs: %v

Error message

error listing VPCs: %v

What it means

VPC.Find lists VPCs via EC2 DescribeVpcs (by ID or by name/tag filters built from e.Name) and wraps any API error with this message. It means the DescribeVpcs call itself failed, not that zero or multiple VPCs matched.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:85

func (e *VPC) CompareWithID() *string {
	return e.ID
}

func (e *VPC) Find(c *fi.CloudupContext) (*VPC, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &ec2.DescribeVpcsInput{}

	if fi.ValueOf(e.ID) != "" {
		request.VpcIds = []string{aws.ToString(e.ID)}
	} else {
		request.Filters = cloud.BuildFilters(e.Name)
	}

	response, err := cloud.EC2().DescribeVpcs(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing VPCs: %v", err)
	}
	if response == nil || len(response.Vpcs) == 0 {
		return nil, nil
	}

	if len(response.Vpcs) != 1 {
		return nil, fmt.Errorf("found multiple VPCs matching tags")
	}
	vpc := response.Vpcs[0]
	actual := &VPC{
		ID:         vpc.VpcId,
		CIDR:       vpc.CidrBlock,
		AmazonIPv6: aws.Bool(false),
		Name:       findNameTag(vpc.Tags),
		Tags:       intersectTags(vpc.Tags, e.Tags),
	}

	klog.V(4).Infof("found matching VPC %v", actual)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v cause for the AWS error code and fix accordingly
2. Verify credentials/region (aws sts get-caller-identity) and that the kops IAM policy includes ec2:DescribeVpcs
3. Re-run the command after transient throttling/5xx errors

// pre-flight: credentials + permission
// aws ec2 describe-vpcs --region <region> --filters Name=tag:KubernetesCluster,Values=<cluster>

if err := kopsUpdate(); err != nil && strings.Contains(err.Error(), "error listing VPCs") {
  var ae smithy.APIError
  if errors.As(err, &ae) && ae.ErrorCode() == "ThrottlingException" {
    return retryAfter(backoff)
  }
  return fmt.Errorf("check AWS credentials/region and ec2:DescribeVpcs IAM: %w", err)
}

When it happens

Trigger: `kops update cluster`/reconciliation calling VPC.Find when EC2 DescribeVpcs errors: invalid filter syntax, missing ec2:DescribeVpcs permission, throttling, or region/credential problems.

Common situations: IAM roles missing ec2:DescribeVpcs; wrong AWS region or expired credentials; API throttling on large applies; malformed cluster name producing an invalid filter value.

Related errors

• error deleting Subnet %q: %v
• error listing subnets: %v
• error describing InternetGateway %q: %v
• error detaching InternetGateway %q: %v
• error describing SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/180dc07107e68b58. Report an issue: GitHub.