kubernetes/kops · error

found %d EIP Addresses for 1 NATGateway, expected 1

Error message

found %d EIP Addresses for 1 NATGateway, expected 1

What it means

When a NAT gateway is found, Find() validates it has exactly one network interface address/EIP; this error fires when the gateway reports multiple addresses. kOps models a NAT gateway with a single Elastic IP, so a multi-address gateway cannot be represented in the task's actual state.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:88

		// We have an existing NGW, lets look up the EIP
		ngwIds := []string{fi.ValueOf(e.ID)}

		request := &ec2.DescribeNatGatewaysInput{
			NatGatewayIds: ngwIds,
		}

		response, err := cloud.EC2().DescribeNatGateways(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing Nat Gateways %v", err)
		}

		if len(response.NatGateways) != 1 {
			return nil, fmt.Errorf("found %d Nat Gateways with ID %q, expected 1", len(response.NatGateways), fi.ValueOf(e.ID))
		}
		ngw = &response.NatGateways[0]

		if len(ngw.NatGatewayAddresses) != 1 {
			return nil, fmt.Errorf("found %d EIP Addresses for 1 NATGateway, expected 1", len(ngw.NatGatewayAddresses))
		}
	} else {
		// This is the normal/default path
		var err error
		ngw, err = e.findNatGateway(c)
		if err != nil {
			return nil, err
		}
		if ngw == nil {
			return nil, nil
		}
	}

	actual.ID = ngw.NatGatewayId

	actual.Subnet = e.Subnet
	if len(ngw.NatGatewayAddresses) == 0 {
		// Not sure if this ever happens

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect addresses: aws ec2 describe-nat-gateways --nat-gateway-ids ngw-xxx --query 'NatGateways[].NatGatewayAddresses'
2. Disassociate the extra EIP so only one remains, then re-run kops (kops edit may reconcile)
3. If manual repair is impractical, delete and let kOps recreate the NAT gateway
4. Audit external automation so it does not attach additional addresses

Example fix

// before: two EIPs attached
aws ec2 disassociate-address --association-id eipassoc-extra
// after: only the original allocation remains; re-run kops update cluster

if len(ngw.NatGatewayAddresses) != 1 {
  return fmt.Errorf("NAT gateway %s must have exactly one EIP, has %d", id, len(ngw.NatGatewayAddresses))
}

if err := findErr; err != nil && strings.Contains(err.Error(), "EIP Addresses") {
  // disassociate extra EIPs then re-run reconcile
}

When it happens

Trigger: ngw.NatGatewayAddresses has length >1 — typically a NAT gateway whose EIP was manually reassociated, or gateways mutated by external tooling adding secondary addresses.

Common situations: Manual EIP association/disassociation via console during IP reshuffling; automation reassigning EIPs; corrupted/merged gateways after failed migrations.

Related errors

• error from DescribeAddresses: %v
• error finding AssociatedNatGatewayRouteTable: %v
• found multiple elastic IPs attached to NatGateway %q
• error describing addresses: %v
• error describing RouteTables: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ab7b70618c06b14d. Report an issue: GitHub.