{"record":{"id":"4aa2d0707080583f","repo":"kubernetes/kops","slug":"subnet-not-set","errorCode":null,"errorMessage":"Subnet not set","messagePattern":"Subnet not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":336,"sourceCode":"\t\trequest.SubnetId = e.Subnet.ID\n\t\tresponse, err := t.Cloud.EC2().CreateNatGateway(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Error creating Nat Gateway: %v\", err)\n\t\t}\n\t\te.ID = response.NatGateway.NatGatewayId\n\t\tid = e.ID\n\t} else {\n\t\tid = a.ID\n\t}\n\n\terr := t.AddAWSTags(*e.ID, e.Tags)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to tag NatGateway\")\n\t}\n\n\t// Tag the associated subnet\n\tif e.Subnet == nil {\n\t\treturn fmt.Errorf(\"Subnet not set\")\n\t} else if e.Subnet.ID == nil {\n\t\treturn fmt.Errorf(\"Subnet ID not set\")\n\t}\n\n\t// TODO: AssociatedNatgateway tag is obsolete - we can get from the route table instead\n\ttags := make(map[string]string)\n\ttags[\"AssociatedNatgateway\"] = *id\n\terr = t.AddAWSTags(*e.Subnet.ID, tags)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unable to tag subnet %v\", err)\n\t}\n\n\t// If this is a shared NGW, we need to tag it\n\t// The tag that implies \"shared\" is `AssociatedNatgateway`=> NGW-ID\n\t// This is better than just a tag that's shared because this lets us create a whitelist of these NGWs\n\t// without doing a bunch more work in `kutil/delete_cluster.go`\n\n\tif fi.ValueOf(e.Shared) {","sourceCodeStart":318,"sourceCodeEnd":354,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L318-L354","documentation":"RenderAWS requires e.Subnet to be set before tagging the subnet with the AssociatedNatgateway tag. A nil Subnet means the NatGateway task was constructed without its subnet link, indicating a spec/task-building bug, so it fails fast.","triggerScenarios":"e.Subnet == nil in RenderAWS — the NatGateway task's Subnet link was never populated during taskmap/build of the cluster spec (e.g. subnet task missing or misnamed in the spec so the link resolves to nil).","commonSituations":"Hand-edited cluster specs referencing a subnet name that doesn't exist; kops internal wiring issues after version upgrades; custom code constructing NatGateway tasks without Subnet.","solutions":["Check `kops get cluster -o yaml` and ensure each private subnet definition is intact and named consistently","Re-generate the spec rather than hand-editing, then `kops update cluster --yes`","If you hit this from custom code, always assign e.Subnet = &SubnetTask{...} link before RenderAWS","Upgrade kops to the latest patch release in case it's a known task-wiring bug"],"exampleFix":"// before: subnet reference dropped\n// cluster spec private subnet removed but NatGateway task remains\n// after: restore the subnet definition\nsubnets:\n- name: private-a\n  type: Private\n  zone: us-east-1a","handlingStrategy":"validation","validationCode":"// before apply, ensure every private subnet resolves\nfor _, s := range cluster.Spec.Subnets {\n  if s.Type == \"Private\" && s.Name == \"\" { return fmt.Errorf(\"private subnet entry missing name\") }\n}","typeGuard":"func subnetLinked(e *NatGateway) bool { return e.Subnet != nil }","tryCatchPattern":"err := applyCluster(ctx)\nif err != nil && strings.Contains(err.Error(), \"Subnet not set\") {\n  // inspect task wiring: restore the missing subnet definition in the cluster spec\n}","preventionTips":["Keep subnet definitions and NatGateway task names consistent in the spec","Prefer `kops edit cluster` over raw manifest edits","After kops upgrades, run `kops update cluster --dry-run` to catch broken task links"],"tags":["aws","natgateway","configuration","subnet"],"backgroundTag":"missing-required-task-reference","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}