kubernetes/kops · error

VPC ID is required when InternetGateway is shared

Error message

VPC ID is required when InternetGateway is shared

What it means

When the InternetGateway task is marked Shared, kOps does not create a gateway — it must find an existing one by VPC ID. Find validates this up front and fails if e.VPC.ID is empty, because without a VPC ID the DescribeInternetGateways filter cannot be built.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/internetgateway.go:77

	}

	if len(response.InternetGateways) != 1 {
		return nil, fmt.Errorf("found multiple InternetGateways matching tags")
	}
	igw := response.InternetGateways[0]
	return &igw, nil
}

func (e *InternetGateway) Find(c *fi.CloudupContext) (*InternetGateway, error) {
	ctx := c.Context()
	cloud := awsup.GetCloud(c)

	request := &ec2.DescribeInternetGatewaysInput{}

	shared := fi.ValueOf(e.Shared)
	if shared {
		if fi.ValueOf(e.VPC.ID) == "" {
			return nil, fmt.Errorf("VPC ID is required when InternetGateway is shared")
		}

		request.Filters = []ec2types.Filter{awsup.NewEC2Filter("attachment.vpc-id", *e.VPC.ID)}
	} else {
		if e.ID != nil {
			request.InternetGatewayIds = []string{fi.ValueOf(e.ID)}
		} else {
			request.Filters = cloud.BuildFilters(e.Name)
		}
	}

	igw, err := findInternetGateway(ctx, cloud, request)
	if err != nil {
		return nil, err
	}
	if igw == nil {
		return nil, nil
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the VPC ID explicitly in the cluster spec (spec.networkID / shared VPC configuration).
2. If the VPC is shared from another account, ensure spec.networkID is populated before the task runs.
3. Set shared: false if kOps should manage the VPC/IGW itself.

Example fix

// before
spec:
  networkID: ""
  internetGatewayID: shared
// after
spec:
  networkID: vpc-0123456789abcdef0
  internetGatewayID: shared

// Check cluster spec before applying
if shared && (cluster.Spec.NetworkID == "" || !strings.HasPrefix(cluster.Spec.NetworkID, "vpc-")) {
    return fmt.Errorf("shared internet gateway requires a valid VPC ID")
}

if strings.Contains(err.Error(), "VPC ID is required when InternetGateway is shared") {
    return fmt.Errorf("fix cluster spec: set spec.networkID to the shared VPC id")
}

When it happens

Trigger: e.Shared is true but fi.ValueOf(e.VPC.ID) == "" during Find — i.e. the cluster spec declares a shared IGW without supplying the VPC ID it is attached to.

Common situations: Shared-VPC clusters where the user set shared: true on the IGW but left the VPC reference empty or only set it by name, malformed cluster spec after editing, templating variable that rendered empty.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• AWS partition was empty
• Region is not a recognized EC2 region: %q (check you have sp
• --region is required (when --external)
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a3ec7ea2ed0d6f3c. Report an issue: GitHub.