kubernetes/kops · error

unable to tag NatGateway

Error message

unable to tag NatGateway

What it means

After creating/locating the NAT gateway, RenderAWS applies the task's tags with t.AddAWSTags. That call failed, so the gateway exists but is untagged — kops relies on these tags (e.g. KubernetesCluster, AssociatedNatgateway) for later lookups, so the error is not swallowed.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:331

		request := &ec2.CreateNatGatewayInput{
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeNatgateway, e.Tags),
		}
		request.AllocationId = e.ElasticIP.ID
		request.SubnetId = e.Subnet.ID
		response, err := t.Cloud.EC2().CreateNatGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("Error creating Nat Gateway: %v", err)
		}
		e.ID = response.NatGateway.NatGatewayId
		id = e.ID
	} else {
		id = a.ID
	}

	err := t.AddAWSTags(*e.ID, e.Tags)
	if err != nil {
		return fmt.Errorf("unable to tag NatGateway")
	}

	// Tag the associated subnet
	if e.Subnet == nil {
		return fmt.Errorf("Subnet not set")
	} else if e.Subnet.ID == nil {
		return fmt.Errorf("Subnet ID not set")
	}

	// TODO: AssociatedNatgateway tag is obsolete - we can get from the route table instead
	tags := make(map[string]string)
	tags["AssociatedNatgateway"] = *id
	err = t.AddAWSTags(*e.Subnet.ID, tags)
	if err != nil {
		return fmt.Errorf("unable to tag subnet %v", err)
	}

	// If this is a shared NGW, we need to tag it

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops update cluster --yes` to retry tagging the now-existing gateway
2. Ensure IAM policy includes ec2:CreateTags on the cluster resources
3. If it recurs consistently, patch the error to include the underlying cause (`fmt.Errorf("unable to tag NatGateway: %v", err)`) to ease diagnosis

Example fix

// before
return fmt.Errorf("unable to tag NatGateway")
// after
return fmt.Errorf("unable to tag NatGateway: %v", err)

// pre-check tag permissions
_, err := ec2Client.CreateTags(ctx, &ec2.CreateTagsInput{Resources: []string{gatewayID}, Tags: toEC2Tags(tags)})
if err != nil { return fmt.Errorf("tag pre-check failed: %w", err) }

err := applyCluster(ctx)
if err != nil && strings.Contains(err.Error(), "unable to tag NatGateway") {
  // idempotent: just re-run kops update cluster --yes after fixing IAM/throttling
}

When it happens

Trigger: t.AddAWSTags(*e.ID, e.Tags) returns err — note the original err detail is dropped, so the cause is hidden: typically CreateTags AccessDenied, throttling, or a just-created gateway not yet visible to the Tags API.

Common situations: IAM policy missing ec2:CreateTags; API throttling right after creation; eventual-consistency window where the new gateway ID isn't yet taggable.

Related errors

• found multiple tags for: %v
• Could not find '%s' tag from route table
• found multiple Volumes with name: %s
• error adding AWS Tags to EBS Volume: %v
• found multiple EgressOnlyInternetGateways matching tags

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/15f4dc81d9a7b11e. Report an issue: GitHub.