kubernetes/kops · error
found multiple InternetGateways matching tags
Error message
found multiple InternetGateways matching tags
What it means
findInternetGateway requires exactly one Internet Gateway to match the supplied filters/tags. When the DescribeInternetGateways response contains more than one match, kOps cannot determine which gateway the task refers to and aborts with this error.
Source
Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:62
}
var _ fi.CompareWithID = (*InternetGateway)(nil)
func (e *InternetGateway) CompareWithID() *string {
return e.ID
}
func findInternetGateway(ctx context.Context, cloud awsup.AWSCloud, request *ec2.DescribeInternetGatewaysInput) (*ec2types.InternetGateway, error) {
response, err := cloud.EC2().DescribeInternetGateways(ctx, request)
if err != nil {
return nil, fmt.Errorf("error listing InternetGateways: %v", err)
}
if response == nil || len(response.InternetGateways) == 0 {
return nil, nil
}
if len(response.InternetGateways) != 1 {
return nil, fmt.Errorf("found multiple InternetGateways matching tags")
}
igw := response.InternetGateways[0]
return &igw, nil
}
func (e *InternetGateway) Find(c *fi.CloudupContext) (*InternetGateway, error) {
ctx := c.Context()
cloud := awsup.GetCloud(c)
request := &ec2.DescribeInternetGatewaysInput{}
shared := fi.ValueOf(e.Shared)
if shared {
if fi.ValueOf(e.VPC.ID) == "" {
return nil, fmt.Errorf("VPC ID is required when InternetGateway is shared")
}
request.Filters = []ec2types.Filter{awsup.NewEC2Filter("attachment.vpc-id", *e.VPC.ID)}View on GitHub (pinned to 4c8573c808)
Solutions
- Detach or delete the redundant Internet Gateway(s) so exactly one matches the filters.
- Remove the duplicate kops tags from gateways that should not be selected.
- Use a more specific filter — set e.ID or the exact shared IGW ID instead of tag-only lookup.
- Audit the VPC with `aws ec2 describe-internet-gateways --filters Name=attachment.vpc-id,Values=<vpc-id>`.
Example fix
// before: two IGWs tagged kubernetes.io/cluster/<cluster> on the VPC // after: remove tag from the unused one aws ec2 delete-tags --resources igw-0EXTRA123 --tags Key=kubernetes.io/cluster/<cluster>
Defensive patterns
Strategy: validation
Validate before calling
aws ec2 describe-internet-gateways \ --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned \ --query 'length(InternetGateways)' # must print exactly 1 before running kops
Try / catch
if strings.Contains(err.Error(), "found multiple InternetGateways matching tags") {
// enumerate and remove the duplicate gateways before retrying
return fmt.Errorf("resolve duplicate IGWs in VPC: %w", err)
} Prevention
- Never duplicate kops cluster tags onto multiple gateways in one VPC.
- Clean up leftover gateways from aborted cluster deletes.
- Prefer specifying an explicit IGW ID over tag-only discovery for shared VPCs.
- Audit VPC attachments periodically.
When it happens
Trigger: DescribeInternetGateways with tag filters (Find path) or attachment.vpc-id filter (shared path) returns len(response.InternetGateways) > 1.
Common situations: Multiple IGWs attached to the same shared VPC (e.g. one leftover from a previous setup plus another tagged one), duplicated kops tags applied to several gateways, manual copying of tags to another IGW.
Related errors
- error describing InternetGateway %q: %v
- found multiple InternetGateways with id %q
- error detaching InternetGateway %q: %v
- error deleting InternetGateway %q: %v
- error listing InternetGateway: %v
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/ae2e73121a726995.
Report an issue: GitHub.