{"record":{"id":"72cdc2b847a9f5c9","repo":"kubernetes/kops","slug":"found-multiple-public-subnets-in-zone-q","errorCode":null,"errorMessage":"found multiple public subnets in zone: %q","messagePattern":"found multiple public subnets in zone: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/context.go","lineNumber":55,"sourceCode":"\nfunc (b *AWSModelContext) LinkToPublicSubnetInZone(zoneName string) (*awstasks.Subnet, error) {\n\tvar matches []*kops.ClusterSubnetSpec\n\tfor i := range b.Cluster.Spec.Networking.Subnets {\n\t\tz := &b.Cluster.Spec.Networking.Subnets[i]\n\t\tif z.Zone != zoneName {\n\t\t\tcontinue\n\t\t}\n\t\tif z.Type != kops.SubnetTypePublic {\n\t\t\tcontinue\n\t\t}\n\t\tmatches = append(matches, z)\n\t}\n\tif len(matches) == 0 {\n\t\treturn nil, fmt.Errorf(\"could not find public subnet in zone: %q\", zoneName)\n\t}\n\tif len(matches) > 1 {\n\t\t// TODO: Support this (arbitrary choice I think, for ELBs)\n\t\treturn nil, fmt.Errorf(\"found multiple public subnets in zone: %q\", zoneName)\n\t}\n\n\treturn b.LinkToSubnet(matches[0]), nil\n}\n\nfunc (b *AWSModelContext) LinkToUtilitySubnetInZone(zoneName string) (*awstasks.Subnet, error) {\n\tvar matches []*kops.ClusterSubnetSpec\n\tfor i := range b.Cluster.Spec.Networking.Subnets {\n\t\ts := &b.Cluster.Spec.Networking.Subnets[i]\n\t\tif s.Zone != zoneName {\n\t\t\tcontinue\n\t\t}\n\t\tif s.Type != kops.SubnetTypeUtility {\n\t\t\tcontinue\n\t\t}\n\t\tmatches = append(matches, s)\n\t}\n\tif len(matches) == 0 {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/context.go#L37-L73","documentation":"The same helper, LinkToPublicSubnetInZone, requires exactly one public subnet per zone; if two or more subnet specs in the same zone have type \"public\", it refuses to pick arbitrarily and returns this error. The limitation is explicit in the code (TODO: support multiple, arbitrary choice for ELBs).","triggerScenarios":"Cluster spec defines two or more spec.networking.subnets entries with type: public sharing the same zone value (e.g. two CIDRs in one AZ for expansion), then any model build that calls LinkToPublicSubnetInZone for that zone fails.","commonSituations":"Users adding extra public subnets to an AZ for more IP space, copied-and-renamed subnet blocks where the zone was left unchanged, or automation scaling out subnet definitions without adjusting zones.","solutions":["Remove the duplicate public subnet entry for that zone, keeping exactly one","Merge the needed CIDR into the existing public subnet instead of adding a second public subnet in the same AZ","Give the second subnet a distinct type (only if it is genuinely not public/internet-facing) or move it to another zone"],"exampleFix":"// before (cluster.yaml)\nsubnets:\n- name: public-a-1\n  type: public\n  zone: us-east-1a\n- name: public-a-2\n  type: public\n  zone: us-east-1a\n// after\nsubnets:\n- name: public-a-1\n  type: public\n  zone: us-east-1a","handlingStrategy":"validation","validationCode":"counts := map[string]int{}\nfor _, s := range cluster.Spec.Networking.Subnets {\n    if s.Type == kops.SubnetTypePublic {\n        counts[s.Zone]++\n    }\n}\nfor zone, n := range counts {\n    if n > 1 {\n        return fmt.Errorf(\"zone %q has %d public subnets; exactly one is required\", zone, n)\n    }\n}","typeGuard":null,"tryCatchPattern":"subnet, err := b.LinkToPublicSubnetInZone(zone)\nif err != nil {\n    if strings.Contains(err.Error(), \"found multiple public subnets in zone\") {\n        return fmt.Errorf(\"keep exactly one public subnet per zone %q: %w\", zone, err)\n    }\n    return err\n}","preventionTips":["Maintain a one-public-subnet-per-zone invariant when adding capacity; widen the CIDR instead","After copying subnet blocks, always update both name and zone","Validate subnet uniqueness (name+zone+type) in CI before running kops update"],"tags":["kops","aws","subnet","topology","zone"],"backgroundTag":"multiple-public-subnets-in-zone","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}