kubernetes/kops · error

unable to tag route table %v

Error message

unable to tag route table %v

What it means

After tagging the subnet, a shared NAT gateway also tags its associated route table via AddAWSTags(fi.ValueOf(e.AssociatedRouteTable.ID), tags). If the AWS CreateTags call for the route table fails, RenderAWS wraps it as "unable to tag route table %v".

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:361

	tags["AssociatedNatgateway"] = *id
	err = t.AddAWSTags(*e.Subnet.ID, tags)
	if err != nil {
		return fmt.Errorf("unable to tag subnet %v", err)
	}

	// If this is a shared NGW, we need to tag it
	// The tag that implies "shared" is `AssociatedNatgateway`=> NGW-ID
	// This is better than just a tag that's shared because this lets us create a whitelist of these NGWs
	// without doing a bunch more work in `kutil/delete_cluster.go`

	if fi.ValueOf(e.Shared) {
		if e.AssociatedRouteTable == nil {
			return fmt.Errorf("AssociatedRouteTable not provided")
		}
		klog.V(2).Infof("tagging route table %s to track shared NGW", fi.ValueOf(e.AssociatedRouteTable.ID))
		err = t.AddAWSTags(fi.ValueOf(e.AssociatedRouteTable.ID), tags)
		if err != nil {
			return fmt.Errorf("unable to tag route table %v", err)
		}
	}

	return nil
}

type terraformNATGateway struct {
	AllocationID *terraformWriter.Literal `cty:"allocation_id"`
	SubnetID     *terraformWriter.Literal `cty:"subnet_id"`
	Tag          map[string]string        `cty:"tags"`
}

func (_ *NatGateway) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *NatGateway) error {
	if fi.ValueOf(e.Shared) {
		if e.ID == nil {
			return fmt.Errorf("ID must be set, if NatGateway is shared: %s", e)
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped cause: fix IAM (allow ec2:CreateTags on route-table ARNs) if UnauthorizedOperation
2. If the route table is not found, correct the AssociatedRouteTable ID in the spec and re-apply
3. Retry on transient throttling errors

Example fix

// before
policy without route-table tag permission
// after
allow ec2:CreateTags on arn:aws:ec2:*:*:route-table/*

_, err := cloud.EC2().DescribeRouteTables(&ec2.DescribeRouteTablesInput{RouteTableIds: []string{*rtID}})
if err != nil { return fmt.Errorf("route table %s missing: %w", *rtID, err) }

if err != nil {
    var awsErr smithy.APIError
    if errors.As(err, &awsErr) && awsErr.ErrorCode() == "UnauthorizedOperation" {
        // fix IAM: ec2:CreateTags on route-table ARNs
    }
}

When it happens

Trigger: AddAWSTags on the route table returns an error during RenderAWS of a shared NGW — InvalidRouteTableID.NotFound, ec2:CreateTags authorization failure, or AWS throttling.

Common situations: IAM policy not allowing ec2:CreateTags on route tables; route table deleted externally; transient AWS API errors during apply.

Related errors

• error describing RouteTables: %v
• error from DescribeRouteTables: %v
• error finding AssociatedNatGatewayRouteTable: %v
• unable to tag subnet %v
• DIGITALOCEAN_ACCESS_TOKEN is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/453302cd714c6e96. Report an issue: GitHub.