kubernetes/kops · error

found multiple EgressOnlyInternetGateways matching tags

Error message

found multiple EgressOnlyInternetGateways matching tags

What it means

findEgressOnlyInternetGateway found more than one Egress-Only Internet Gateway matching the task's tag filters, making it ambiguous which one kOps manages. It returns an error instead of guessing, protecting against wiring the cluster's IPv6 egress through the wrong gateway.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/egressonlyinternetgateway.go:62

}

var _ fi.CompareWithID = (*EgressOnlyInternetGateway)(nil)

func (e *EgressOnlyInternetGateway) CompareWithID() *string {
	return e.ID
}

func findEgressOnlyInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2types.EgressOnlyInternetGateway, error) {
	response, err := cloud.EC2().DescribeEgressOnlyInternetGateways(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing EgressOnlyInternetGateways: %v", err)
	}
	if response == nil || len(response.EgressOnlyInternetGateways) == 0 {
		return nil, nil
	}

	if len(response.EgressOnlyInternetGateways) != 1 {
		return nil, fmt.Errorf("found multiple EgressOnlyInternetGateways matching tags")
	}
	igw := response.EgressOnlyInternetGateways[0]
	return &igw, nil
}

func (e *EgressOnlyInternetGateway) Find(c *fi.CloudupContext) (*EgressOnlyInternetGateway, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &ec2.DescribeEgressOnlyInternetGatewaysInput{}

	shared := fi.ValueOf(e.Shared)
	if shared {
		if fi.ValueOf(e.VPC.ID) == "" {
			return nil, fmt.Errorf("VPC ID is required when EgressOnlyInternetGateway is shared")
		}

		request.Filters = []ec2types.Filter{awsup.NewEC2Filter("attachment.vpc-id", *e.VPC.ID)}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List matching gateways with `aws ec2 describe-egress-only-internet-gateways` and delete or retag the duplicate
2. Keep the gateway whose attachments correspond to the cluster VPC; remove the stray one
3. Make the name tag value unique per cluster in the spec
4. Re-run `kops update cluster` after cleanup

Example fix

// before
aws ec2 create-egress-only-internet-gateway --tag-specifications 'ResourceType=egress-only-internet-gateway,Tags=[{Key=Name,Value=mycluster-eigw}]'  // duplicate
// after
aws ec2 delete-egress-only-internet-gateway --egress-only-internet-gateway-id eigw-duplicate-id  // keep only one match

// Fail fast when tags match more than one gateway
out, _ := ec2Client.DescribeEgressOnlyInternetGateways(ctx, &ec2.DescribeEgressOnlyInternetGatewaysInput{Filters: nameTagFilters})
if len(out.EgressOnlyInternetGateways) > 1 {
    return fmt.Errorf("%d egress-only IGWs match tag; dedupe before updating", len(out.EgressOnlyInternetGateways))
}

When it happens

Trigger: DescribeEgressOnlyInternetGateways with the kOps name-tag filter returns 2+ gateways — usually from a duplicated gateway created manually or by re-running creation outside kOps, or colliding name tags across stacks.

Common situations: Manually creating an Egress-Only IGW with the same tag; partial cleanup after a failed cluster delete; multi-cluster environments sharing tag naming.

Related errors

• error listing EgressOnlyInternetGateways: %v
• failed to assign prefix: %w
• unexpected number of network interfaces for instance %q: %v
• unexpected amount of ipv6 prefixes on interface %q: %v
• cannot determine challenge endpoint for instance id: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cd00e41f8ff8ae4a. Report an issue: GitHub.