{"record":{"id":"b9b91c570486c288","repo":"kubernetes/kops","slug":"could-not-determine-any-subnets-for-instancegroup","errorCode":null,"errorMessage":"could not determine any subnets for InstanceGroup %q; subnets was %s","messagePattern":"could not determine any subnets for InstanceGroup %q; subnets was (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/autoscalinggroup.go","lineNumber":461,"sourceCode":"\t\tminSize = new(int32(*ig.Spec.MinSize))\n\t} else if ig.Spec.Role.HasNode() {\n\t\tminSize = new(int32(2))\n\t}\n\tif ig.Spec.MaxSize != nil {\n\t\tmaxSize = new(int32(*ig.Spec.MaxSize))\n\t} else if ig.Spec.Role.HasNode() {\n\t\tmaxSize = new(int32(2))\n\t}\n\n\tt.MinSize = minSize\n\tt.MaxSize = maxSize\n\n\tsubnets, err := b.GatherSubnets(ig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(subnets) == 0 {\n\t\treturn nil, fmt.Errorf(\"could not determine any subnets for InstanceGroup %q; subnets was %s\", ig.ObjectMeta.Name, ig.Spec.Subnets)\n\t}\n\tfor _, subnet := range subnets {\n\t\tt.Subnets = append(t.Subnets, b.LinkToSubnet(subnet))\n\t}\n\n\ttags, err := b.CloudTagsForInstanceGroup(ig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building cloud tags: %v\", err)\n\t}\n\tt.Tags = tags\n\n\tprocesses := []string{}\n\tprocesses = append(processes, ig.Spec.SuspendProcesses...)\n\tt.SuspendProcesses = &processes\n\n\tif ig.Spec.InstanceProtection != nil {\n\t\tt.InstanceProtection = ig.Spec.InstanceProtection\n\t}","sourceCodeStart":443,"sourceCodeEnd":479,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/autoscalinggroup.go#L443-L479","documentation":"buildAutoScalingGroupTask resolves the subnets for the instance group via GatherSubnets; after resolution it guards that at least one subnet was found. If the group's subnet references resolve to zero subnet objects, the ASG task cannot be placed in any VPC and Build fails with this message, echoing the raw spec.subnets list.","triggerScenarios":"`kops update cluster` when spec.instanceGroup.spec.subnets lists names that don't exist in spec.networking / cluster subnets, the subnets list is empty, or a subnet is defined only in a zone/utility allocation that GatherSubnets filters out (e.g. referencing a subnet name that maps to no CIDR/zone).","commonSituations":"Typo'd subnet names in the instance group vs cluster spec; instance group moved to a zone with no matching subnet; cluster.yaml edited after removing a subnet from the cluster spec but leaving it on instance groups; trying to place a master/node IG only in utility subnets.","solutions":["Run `kops get cluster -oyaml` and cross-check every name in the instance group's spec.subnets against the cluster's spec.networking.subnets names — fix typos or add the missing subnet to the cluster spec.","Ensure each instance group's subnets include at least one subnet whose name matches a cluster subnet entry with a valid zone and cidr.","If subnets were removed intentionally, update the instance group: `kops edit instancegroup <ig>` and set reachable subnets, then `kops update cluster`.","For new zones, first add the subnet to the cluster spec (with zone/cidr) before referencing it from an instance group."],"exampleFix":"// before (instancegroup.yaml)\nmetadata:\n  name: nodes\nspec:\n  subnets: [\"us-east-1b-private\"]  # not defined in cluster\n// after\nspec:\n  subnets: [\"us-east-1a-private\"]  # matches cluster spec subnet name","handlingStrategy":"validation","validationCode":"# ensure every instance-group subnet exists in the cluster spec\ncluster_subnets=$(kops get cluster -oyaml | yq '.spec.networking.subnets[].name' | sort)\nfor ig in $(kops get ig -oname); do\n  for s in $(kops get ig \"$ig\" -oyaml | yq '.spec.subnets[]'); do\n    echo \"$cluster_subnets\" | grep -qx \"$s\" || { echo \"$ig references unknown subnet: $s\"; exit 1; }\n  done\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always define subnets at cluster level before referencing them in instance groups","After removing/renaming a cluster subnet, update all instance groups that referenced it","Keep at least one valid subnet per instance group; avoid referencing only utility subnets for nodes/masters","Run a kops update dry run after any topology/zone changes"],"tags":["aws","subnets","instance-group","configuration"],"backgroundTag":"unresolved-subnet-reference","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}