{"record":{"id":"d5f291ddfe250d57","repo":"kubernetes/kops","slug":"error-instance-group-cannot-span-public-and-privat","errorCode":null,"errorMessage":"error instance group cannot span public and private subnets","messagePattern":"error instance group cannot span public and private subnets","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/toolbox_instance-selector.go","lineNumber":489,"sourceCode":"\t\t}\n\t\tif !userSubnetValid {\n\t\t\treturn fmt.Errorf(\"error subnets must exist in the cluster\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateAllPrivateOrPublicSubnets makes sure the passed in subnets are all utility (public) subnets or private subnets\nfunc validateAllPrivateOrPublicSubnets(userSubnets []string) error {\n\tutilitySubnets := 0\n\tfor _, userSubnet := range userSubnets {\n\t\tif strings.HasPrefix(userSubnet, \"utility-\") {\n\t\t\tutilitySubnets++\n\t\t}\n\t}\n\n\tif utilitySubnets != 0 && len(userSubnets) != utilitySubnets {\n\t\treturn fmt.Errorf(\"error instance group cannot span public and private subnets\")\n\t}\n\treturn nil\n}\n\nfunc createInstanceGroup(groupName, clusterName string, subnets []string) *kops.InstanceGroup {\n\tig := &kops.InstanceGroup{}\n\tig.ObjectMeta.Name = groupName\n\tig.Spec.Role = kops.InstanceGroupRoleNode\n\tig.Spec.Subnets = subnets\n\tig.ObjectMeta.Labels = make(map[string]string)\n\tig.ObjectMeta.Labels[kops.LabelClusterName] = clusterName\n\n\tig.AddInstanceGroupNodeLabel()\n\treturn ig\n}\n\nfunc decorateWithInstanceGroupSpecs(instanceGroup *kops.InstanceGroup, instanceGroupOpts *InstanceSelectorOptions) *kops.InstanceGroup {\n\tig := instanceGroup","sourceCodeStart":471,"sourceCodeEnd":507,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/toolbox_instance-selector.go#L471-L507","documentation":"Thrown by validateAllPrivateOrPublicSubnets during `kops toolbox instance-selector` subnet validation. It counts subnets prefixed with \"utility-\" (kOps public subnets) and rejects the request when the subnet list mixes utility (public) and non-utility (private) subnets, because an instance group spanning both public and private subnets is not a supported configuration.","triggerScenarios":"Passing a --subnets list to `kops toolbox instance-selector` that contains at least one \"utility-*\" subnet and at least one subnet without the \"utility-\" prefix (e.g. --subnets us-east-1a,utility-us-east-1a).","commonSituations":"Mixing public and private subnets when defining node instance groups; assuming kOps will auto-route a group across both; generated scripts from a public cluster reused on a private-topology cluster (or vice versa); misunderstanding that the utility- prefix denotes public subnets.","solutions":["Use only private subnets for the instance group: drop the utility- prefixed entries from --subnets","Or use only utility- (public) subnets if the group truly must be public (rare for nodes; typical only for bastions)","Check the cluster topology: `kops get cluster -o yaml` and match instance group subnets to one class of subnets","For a public-facing role, create a separate instance group rather than mixing subnets in one group"],"exampleFix":"// before\nkops toolbox instance-selector --name nodes --subnets us-east-1a,utility-us-east-1b\n\n// after (private group)\nkops toolbox instance-selector --name nodes --subnets us-east-1a,us-east-1b","handlingStrategy":"validation","validationCode":"utility := 0\nfor _, s := range requestedSubnets {\n    if strings.HasPrefix(s, \"utility-\") { utility++ }\n}\nif utility != 0 && utility != len(requestedSubnets) {\n    return fmt.Errorf(\"subnets mix public (utility-*) and private; pick one class\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Decide group topology (public vs private) before writing subnet flags","Never mix utility- prefixed and bare subnets in one instance group","Name private subnets without the utility- prefix to keep the convention clear","Derive subnet lists programmatically from the cluster spec filtered by prefix"],"tags":["kops","subnets","topology","validation"],"backgroundTag":"mixed-public-private-subnets","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}