{"record":{"id":"3e65a67c0d0e7ac7","repo":"kubernetes/kops","slug":"invalid-networking-option-s-kubenet-does-not-sup","errorCode":null,"errorMessage":"invalid networking option %s. Kubenet does not support private topology","messagePattern":"invalid networking option (.+?)\\. Kubenet does not support private topology","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/new_cluster.go","lineNumber":1401,"sourceCode":"\terr := setupDNSTopology(opt, cluster)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tswitch opt.Topology {\n\tcase api.TopologyPublic:\n\n\t\tif opt.Bastion {\n\t\t\treturn nil, fmt.Errorf(\"bastion supports --topology='private' only\")\n\t\t}\n\n\t\tfor i := range cluster.Spec.Networking.Subnets {\n\t\t\tcluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePublic\n\t\t}\n\n\tcase api.TopologyPrivate:\n\t\tif cluster.Spec.Networking.Kubenet != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid networking option %s. Kubenet does not support private topology\", opt.Networking)\n\t\t}\n\n\t\tfor i := range cluster.Spec.Networking.Subnets {\n\t\t\tcluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePrivate\n\t\t}\n\n\t\tvar zoneToSubnetProviderID map[string]string\n\t\tvar err error\n\t\tif len(opt.Zones) > 0 && len(opt.UtilitySubnetIDs) > 0 {\n\t\t\tswitch cluster.GetCloudProvider() {\n\t\t\tcase api.CloudProviderAWS:\n\t\t\t\tzoneToSubnetProviderID, err = getAWSZoneToSubnetProviderID(cluster.Spec.Networking.NetworkID, opt.Zones[0][:len(opt.Zones[0])-1], opt.UtilitySubnetIDs)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\tcase api.CloudProviderOpenstack:\n\t\t\t\tzoneToSubnetProviderID, err = getOpenstackZoneToSubnetProviderID(cluster, allZones.List(), opt.UtilitySubnetIDs)\n\t\t\t\tif err != nil {","sourceCodeStart":1383,"sourceCodeEnd":1419,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/new_cluster.go#L1383-L1419","documentation":"With private topology, nodes live in private subnets and kops' kubenet networking plugin cannot operate in that layout (it requires public subnets/route handling it does not manage). setupTopology therefore rejects the combination of --topology private with --networking kubenet.","triggerScenarios":"`kops create cluster --topology private --networking kubenet` — the Kubenet spec is non-nil and topology is api.TopologyPrivate, so setupTopology returns this error.","commonSituations":"Using legacy templates that defaulted to kubenet while upgrading to private topology; following old tutorials recommending kubenet; mixing flags from different guides.","solutions":["Switch networking to a private-topology-compatible plugin, e.g. --networking calico, cilium, or canal.","Keep --networking kubenet but use --topology public (if acceptable).","Update cluster templates to a modern CNI before switching to private topology."],"exampleFix":"// before\nkops create cluster my.cluster --topology private --networking kubenet\n// after\nkops create cluster my.cluster --topology private --networking calico","handlingStrategy":"validation","validationCode":"if [ \"$TOPOLOGY\" = \"private\" ] && [ \"$NETWORKING\" = \"kubenet\" ]; then echo \"kubenet unsupported with private topology\"; exit 1; fi","typeGuard":null,"tryCatchPattern":"if err := createCluster(); err != nil && strings.Contains(err.Error(), \"Kubenet does not support private topology\") { /* switch to calico/cilium/canal and retry */ }","preventionTips":["Use calico/cilium/canal for private clusters","Migrate legacy kubenet templates before enabling private topology","Pin CNI choice centrally in one script variable"],"tags":["networking","topology","kubenet","compatibility"],"backgroundTag":"incompatible-networking-topology","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}