kubernetes/kops · error

ID must be set, if NatGateway is shared: %s

Error message

ID must be set, if NatGateway is shared: %s

What it means

In RenderTerraform for NatGateway, if the gateway is marked Shared the terraform target cannot create a new one; it requires the existing gateway's ID. When e.Shared is true and e.ID is nil, it errors "ID must be set, if NatGateway is shared: %s".

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:377

		err = t.AddAWSTags(fi.ValueOf(e.AssociatedRouteTable.ID), tags)
		if err != nil {
			return fmt.Errorf("unable to tag route table %v", err)
		}
	}

	return nil
}

type terraformNATGateway struct {
	AllocationID *terraformWriter.Literal `cty:"allocation_id"`
	SubnetID     *terraformWriter.Literal `cty:"subnet_id"`
	Tag          map[string]string        `cty:"tags"`
}

func (_ *NatGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *NatGateway) error {
	if fi.ValueOf(e.Shared) {
		if e.ID == nil {
			return fmt.Errorf("ID must be set, if NatGateway is shared: %s", e)
		}

		klog.V(4).Infof("reusing existing NatGateway with id %q", *e.ID)
		return nil
	}

	tf := &terraformNATGateway{
		AllocationID: e.ElasticIP.TerraformLink(),
		SubnetID:     e.Subnet.TerraformLink(),
		Tag:          e.Tags,
	}

	return t.RenderResource("aws_nat_gateway", *e.Name, tf)
}

func (e *NatGateway) TerraformLink() *terraformWriter.Literal {
	if fi.ValueOf(e.Shared) {
		if e.ID == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the ID field of the shared NatGateway task to the existing nat-gateway ID (nat-xxxxxxxx)
2. Confirm with aws ec2 describe-nat-gateways that the ID exists and is available
3. Re-run kops update --target=terraform

Example fix

// before
shared: true
// after
shared: true
id: nat-0abc1234def567890

if fi.ValueOf(nat.Shared) && nat.ID == nil {
    return fmt.Errorf("shared nat gateway must set ID (nat-...)")
}

When it happens

Trigger: Terraform output target renders a NatGateway task with fi.ValueOf(e.Shared)==true and e.ID==nil — a spec marked shared without supplying the existing NGW's ID (nat-...).

Common situations: Switching a cluster to a pre-existing NAT gateway when using kops update --target=terraform; cluster spec copied from a non-shared setup; ID omitted from the shared config.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• AssociatedRouteTable not provided
• error describing RouteTables: %v
• error describing NatGateways: %v
• error from DescribeRouteTables: %v
• error from DescribeNatGateways: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/763115ab9c44cdc3. Report an issue: GitHub.