kubernetes/kops · error

found multiple InternetGateways with id %q

Error message

found multiple InternetGateways with id %q

What it means

kOps raises this when DescribeInternetGateways returns more than one InternetGateway matching the given ID, which should be impossible in AWS (IDs are unique). It is a defensive sanity check before using the single result. Hitting it indicates an API/SDK-level anomaly or a mock/test setup returning duplicated entries.

Source

Thrown at pkg/resources/aws/aws.go:1021

	var igw *ec2types.InternetGateway
	{
		request := &ec2.DescribeInternetGatewaysInput{
			InternetGatewayIds: []string{id},
		}
		response, err := c.EC2().DescribeInternetGateways(ctx, request)
		if err != nil {
			if awsup.AWSErrorCode(err) == "InvalidInternetGatewayID.NotFound" {
				klog.Infof("Internet gateway %q not found; assuming already deleted", id)
				return nil
			}

			return fmt.Errorf("error describing InternetGateway %q: %v", id, err)
		}
		if response == nil || len(response.InternetGateways) == 0 {
			return nil
		}
		if len(response.InternetGateways) != 1 {
			return fmt.Errorf("found multiple InternetGateways with id %q", id)
		}
		igw = &response.InternetGateways[0]
	}

	for _, a := range igw.Attachments {
		klog.V(2).Infof("Detaching EC2 InternetGateway %q", id)
		request := &ec2.DetachInternetGatewayInput{
			InternetGatewayId: &id,
			VpcId:             a.VpcId,
		}
		_, err := c.EC2().DetachInternetGateway(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			return fmt.Errorf("error detaching InternetGateway %q: %v", id, err)
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the actual AWS account: `aws ec2 describe-internet-gateways --internet-gateway-ids <id>` — a real account should return exactly one
2. If using a mock/EC2-compatible endpoint, fix its describe implementation to return unique entries
3. Retry the kOps delete against real AWS; this is virtually always environmental
4. File an issue with kOps if reproducible against real AWS

Example fix

// defensive handling in caller
if strings.Contains(err.Error(), "found multiple InternetGateways") {
	igws, _ := aws.DescribeInternetGateways(cloud)
	// pick the gateway whose InternetGatewayId == id
}

// verify uniqueness against real AWS before proceeding
out, err := c.EC2().DescribeInternetGateways(ctx, &ec2.DescribeInternetGatewaysInput{
	InternetGatewayIds: []string{id},
})
if err != nil { return err }
if len(out.InternetGateways) != 1 {
	return fmt.Errorf("expected exactly 1 IGW for %s, got %d", id, len(out.InternetGateways))
}

func singleIGW(out *ec2.DescribeInternetGatewaysOutput) *ec2types.InternetGateway {
	if out == nil || len(out.InternetGateways) != 1 {
		return nil
	}
	return &out.InternetGateways[0]
}

if err != nil {
	if strings.Contains(err.Error(), "found multiple InternetGateways") {
		// fall back to re-describing and matching by exact ID
		igws, derr := aws.DescribeInternetGateways(cloud)
		if derr != nil { return derr }
		for _, g := range igws { if aws.ToString(g.InternetGatewayId) == id { /* proceed */ } }
	}
	return err
}

When it happens

Trigger: The DescribeInternetGateways response for a single IGW ID contains len(InternetGateways) != 1 — i.e., 2 or more entries were returned for one ID.

Common situations: Bugs in test doubles or mocked EC2 implementations; SDK/API paging anomalies; running against an API-compatible (e.g., on-prem/AWS-emulating) endpoint that misbehaves.

Related errors

• found multiple instances with instance id: %s
• error describing InternetGateway %q: %v
• error detaching InternetGateway %q: %v
• error deleting InternetGateway %q: %v
• error listing InternetGateway: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3315ded76d2034de. Report an issue: GitHub.