{"record":{"id":"e8c5bd8b29f9ae8c","repo":"kubernetes/kops","slug":"unhandled-bastion-loadbalancer-type-q","errorCode":null,"errorMessage":"unhandled bastion LoadBalancer type %q","messagePattern":"unhandled bastion LoadBalancer type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/bastion.go","lineNumber":112,"sourceCode":"\t\t\t\tEgress:        new(true),\n\t\t\t\tIPv6CIDR:      new(\"::/0\"),\n\t\t\t}\n\t\t\tAddDirectionalGroupRule(c, t)\n\t\t}\n\t}\n\n\tvar bastionLoadBalancerType kops.LoadBalancerType\n\t{\n\t\t// Check if we requested a public or internal NLB\n\t\tif b.Cluster.Spec.Networking.Topology != nil && b.Cluster.Spec.Networking.Topology.Bastion != nil && b.Cluster.Spec.Networking.Topology.Bastion.LoadBalancer != nil {\n\t\t\tif b.Cluster.Spec.Networking.Topology.Bastion.LoadBalancer.Type != \"\" {\n\t\t\t\tswitch b.Cluster.Spec.Networking.Topology.Bastion.LoadBalancer.Type {\n\t\t\t\tcase kops.LoadBalancerTypeInternal:\n\t\t\t\t\tbastionLoadBalancerType = \"Internal\"\n\t\t\t\tcase kops.LoadBalancerTypePublic:\n\t\t\t\t\tbastionLoadBalancerType = \"Public\"\n\t\t\t\tdefault:\n\t\t\t\t\treturn fmt.Errorf(\"unhandled bastion LoadBalancer type %q\", b.Cluster.Spec.Networking.Topology.Bastion.LoadBalancer.Type)\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Default to Public\n\t\t\t\tb.Cluster.Spec.Networking.Topology.Bastion.LoadBalancer.Type = kops.LoadBalancerTypePublic\n\t\t\t\tbastionLoadBalancerType = \"Public\"\n\t\t\t}\n\t\t} else {\n\t\t\t// Default to Public\n\t\t\tbastionLoadBalancerType = \"Public\"\n\t\t}\n\t}\n\n\t// Allow bastion nodes to SSH to control plane\n\tfor _, src := range bastionGroups {\n\t\tfor _, dest := range masterGroups {\n\t\t\tt := &awstasks.SecurityGroupRule{\n\t\t\t\tName:          new(\"bastion-to-master-ssh\" + JoinSuffixes(src, dest)),\n\t\t\t\tLifecycle:     b.SecurityLifecycle,","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/bastion.go#L94-L130","documentation":"kops's BastionModelBuilder.Build translates the cluster spec's bastion load balancer type (spec.networking.topology.bastion.loadBalancer.type) into an ELB/NLB scheme string. Only \"internal\" and \"public\" are recognized; any other value (including an empty string when the surrounding block expected one to be defaulted) makes the builder abort cluster rendering with this error. It is a spec-validation guard inside the AWS model build phase.","triggerScenarios":"Running `kops update cluster` (or `kops create cluster --bastion`) where spec.networking.topology.bastion.loadBalancer.type is set to anything other than \"internal\" or \"public\" — e.g. a typo like \"Internal\", \"private\", or an empty string that bypassed the defaulting branch.","commonSituations":"Hand-edited cluster manifests, YAML migrated from another tool or older kops version with a now-invalid value, case-sensitivity mistakes (value must be lowercase), or automation templates injecting a wrong default.","solutions":["Set spec.networking.topology.bastion.loadBalancer.type to exactly \"internal\" or \"public\" in the cluster manifest","Remove the loadBalancer.type field entirely so the builder defaults it to \"public\"","Run `kops edit cluster` (or the editor of your manifest) and fix casing/typos, then re-run `kops update cluster`"],"exampleFix":"// before (cluster.yaml)\ntopology:\n  bastion:\n    loadBalancer:\n      type: Internal\n// after\ntopology:\n  bastion:\n    loadBalancer:\n      type: internal","handlingStrategy":"validation","validationCode":"t := cluster.Spec.Networking.Topology.Bastion.LoadBalancer.Type\nif t != \"\" && t != kops.LoadBalancerTypeInternal && t != kops.LoadBalancerTypePublic {\n    return fmt.Errorf(\"invalid bastion loadBalancer.type %q: must be \\\"internal\\\" or \\\"public\\\"\", t)\n}","typeGuard":"func validBastionLBType(t kops.LoadBalancerType) bool {\n    return t == kops.LoadBalancerTypeInternal || t == kops.LoadBalancerTypePublic\n}","tryCatchPattern":"if err := buildModel(ctx); err != nil {\n    if strings.Contains(err.Error(), \"unhandled bastion LoadBalancer type\") {\n        return fmt.Errorf(\"fix spec.networking.topology.bastion.loadBalancer.type (internal|public): %w\", err)\n    }\n    return err\n}","preventionTips":["Use `kops edit cluster` instead of hand-editing YAML so defaulting/validation runs","Always use lowercase enum values (internal/public)","Omit loadBalancer.type to accept the default (public)","Run `kops validate cluster` or a dry-run before applying"],"tags":["kops","aws","bastion","load-balancer","config-validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}