{"record":{"id":"9fdf1052031458d4","repo":"kubernetes/kops","slug":"error-subnets-must-exist-in-the-cluster","errorCode":null,"errorMessage":"error subnets must exist in the cluster","messagePattern":"error subnets must exist in the cluster","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/toolbox_instance-selector.go","lineNumber":473,"sourceCode":"\terr = validateAllPrivateOrPublicSubnets(userSubnets)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n\n// validateUserSubnetsWithClusterSubnets makes sure the userSubnets are part of the cluster subnets\nfunc validateUserSubnetsWithClusterSubnets(userSubnets []string, clusterSubnets []kops.ClusterSubnetSpec) error {\n\tfor _, userSubnet := range userSubnets {\n\t\tuserSubnetValid := false\n\t\tfor _, clusterSubnet := range clusterSubnets {\n\t\t\tif clusterSubnet.Name == userSubnet {\n\t\t\t\tuserSubnetValid = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif !userSubnetValid {\n\t\t\treturn fmt.Errorf(\"error subnets must exist in the cluster\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateAllPrivateOrPublicSubnets makes sure the passed in subnets are all utility (public) subnets or private subnets\nfunc validateAllPrivateOrPublicSubnets(userSubnets []string) error {\n\tutilitySubnets := 0\n\tfor _, userSubnet := range userSubnets {\n\t\tif strings.HasPrefix(userSubnet, \"utility-\") {\n\t\t\tutilitySubnets++\n\t\t}\n\t}\n\n\tif utilitySubnets != 0 && len(userSubnets) != utilitySubnets {\n\t\treturn fmt.Errorf(\"error instance group cannot span public and private subnets\")\n\t}\n\treturn nil","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/toolbox_instance-selector.go#L455-L491","documentation":"This error comes from `kops toolbox instance-selector` when validating user-provided subnets via validateUserSubnetsWithClusterSubnets. Every subnet passed by --subnets (or the instance-selector flags) is checked against the subnets actually defined in the cluster spec (ClusterSpec.Subnets); if even one user subnet name has no matching cluster subnet Name, validation fails and this error is returned. It exists to catch typos and out-of-cluster subnets before an instance group referencing them is created.","triggerScenarios":"Running `kops toolbox instance-selector` with a --subnets value (e.g. \"us-east-1a\" or \"utility-us-east-1a\") that does not match any subnet Name in the target cluster's ClusterSubnetSpec list. Also happens when the wrong cluster name is given, so validation runs against a cluster whose subnet list doesn't include the requested subnets.","commonSituations":"Typo in subnet name; using an AWS subnet ID (subnet-xxxx) instead of the logical subnet name kOps uses; copy-pasting subnets from a different cluster; cluster spec changed and a subnet was renamed/removed while scripts still reference the old name; running against a dev cluster config while reusing prod subnet names.","solutions":["Run `kops get cluster <name> -o yaml` and check spec.subnets names; use exactly those names in --subnets","Fix any typos in the --subnets flag values (names are matched exactly, case-sensitive)","Verify you are targeting the intended cluster with --cluster-name; wrong cluster means wrong subnet list","If a subnet is genuinely missing, add it to the cluster spec (kops edit cluster) and update the cloud before creating the instance group","Use the logical kOps name (e.g. utility-us-east-1a), not the EC2 subnet-ID"],"exampleFix":"// before\nkops toolbox instance-selector --cluster-name prod.example.com --subnets subnet-0abc123def456 --name nodes\n\n// after\nkops toolbox instance-selector --cluster-name prod.example.com --subnets us-east-1a --name nodes","handlingStrategy":"validation","validationCode":"cluster, err := kopsclientset.GetCluster(clusterName)\nif err != nil { return err }\nclusterSubnetNames := sets.NewString()\nfor _, s := range cluster.Spec.Subnets { clusterSubnetNames.Insert(s.Name) }\nfor _, u := range requestedSubnets {\n    if !clusterSubnetNames.Has(u) {\n        return fmt.Errorf(\"subnet %q not found in cluster %q; valid: %v\", u, clusterName, clusterSubnetNames.List())\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always copy subnet names from `kops get cluster -o yaml` rather than typing them","Use logical kOps subnet names (us-east-1a, utility-us-east-1a), never EC2 subnet IDs","Re-validate scripts after editing cluster topology","Pass --cluster-name explicitly so validation runs against the right cluster"],"tags":["kops","subnets","validation","cli"],"backgroundTag":"subnet-not-in-cluster","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}