kubernetes/kops · error

InternetGateway for shared VPC was not found

Error message

InternetGateway for shared VPC was not found

What it means

RenderAWS checks that when the InternetGateway is shared, the Find pass actually located a matching gateway (a != nil). If the existing/shared gateway could not be found, AWS-side application fails with this error instead of attempting creation (which would be wrong for a shared resource).

Source

Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:147

func (s *InternetGateway) CheckChanges(a, e, changes *InternetGateway) error {
	if a != nil {
		// TODO: I think we can change it; we just detach & attach
		if changes.VPC != nil {
			return fi.CannotChangeField("VPC")
		}
	}

	return nil
}

func (_ *InternetGateway) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *InternetGateway) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {
		// Verify the InternetGateway was found and matches our required settings
		if a == nil {
			return fmt.Errorf("InternetGateway for shared VPC was not found")
		}

		return nil
	}

	if a == nil {
		klog.V(2).Infof("Creating InternetGateway")

		request := &ec2.CreateInternetGatewayInput{
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeInternetGateway, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateInternetGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating InternetGateway: %v", err)
		}

		e.ID = response.InternetGateway.InternetGatewayId

View on GitHub (pinned to 4c8573c808)

Solutions

1. Attach an Internet Gateway to the shared VPC (or ask the VPC owner to).
2. Verify spec.networkID points at the correct VPC in the correct region/account.
3. Remove shared/internetGatewayID settings if kOps should create the IGW itself.

Example fix

// before: VPC without IGW, cluster says internetGatewayID: shared
// after: attach one first
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --internet-gateway-id igw-0123 --vpc-id vpc-0123456789abcdef0

aws ec2 describe-internet-gateways \
  --filters Name=attachment.vpc-id,Values=<vpc-id> \
  --query 'length(InternetGateways)'   # must be >= 1 in the target region/account

if strings.Contains(err.Error(), "InternetGateway for shared VPC was not found") {
    return fmt.Errorf("attach an IGW to VPC %s or unset shared mode before retrying", vpcID)
}

When it happens

Trigger: e.Shared is true and a == nil, i.e. the DescribeInternetGateways lookup by attachment.vpc-id found zero matching gateways — the referenced VPC has no attached IGW, or the wrong VPC ID was given.

Common situations: Shared VPC that genuinely has no internet gateway attached, typo'd vpc- ID pointing at a different VPC, gateway detached after cluster creation, cross-account shared VPC where the lookup ran in the wrong account/region.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• error describing InternetGateway %q: %v
• found multiple InternetGateways with id %q
• error detaching InternetGateway %q: %v
• error deleting InternetGateway %q: %v
• error listing InternetGateway: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f4c6dae7a2ccb3ec. Report an issue: GitHub.