{"record":{"id":"e9dc75de0e34e4a0","repo":"kubernetes/kops","slug":"subnet-q-had-unknown-type-q-e9dc75","errorCode":null,"errorMessage":"subnet %q had unknown type %q","messagePattern":"subnet %q had unknown type %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/awsmodel/bastion.go","lineNumber":215,"sourceCode":"\t{\n\t\t// Compute the subnets - only one per zone, and then break ties based on chooseBestSubnetForNLB\n\t\tsubnetsByZone := make(map[string][]*kops.ClusterSubnetSpec)\n\t\tfor i := range b.Cluster.Spec.Networking.Subnets {\n\t\t\tsubnet := &b.Cluster.Spec.Networking.Subnets[i]\n\n\t\t\tswitch subnet.Type {\n\t\t\tcase kops.SubnetTypePublic, kops.SubnetTypeUtility:\n\t\t\t\tif bastionLoadBalancerType != kops.LoadBalancerTypePublic {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\n\t\t\tcase kops.SubnetTypeDualStack, kops.SubnetTypePrivate:\n\t\t\t\tif bastionLoadBalancerType != kops.LoadBalancerTypeInternal {\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"subnet %q had unknown type %q\", subnet.Name, subnet.Type)\n\t\t\t}\n\n\t\t\tsubnetsByZone[subnet.Zone] = append(subnetsByZone[subnet.Zone], subnet)\n\t\t}\n\n\t\tfor zone, subnets := range subnetsByZone {\n\t\t\tfor _, subnet := range subnets {\n\t\t\t\tsshAllowedCIDRs = append(sshAllowedCIDRs, subnet.CIDR)\n\t\t\t}\n\t\t\tsubnet := b.chooseBestSubnetForNLB(zone, subnets)\n\t\t\tnlbSubnetMappings = append(nlbSubnetMappings, &awstasks.SubnetMapping{Subnet: b.LinkToSubnet(subnet)})\n\t\t}\n\t}\n\n\tsshAllowedCIDRs = append(sshAllowedCIDRs, b.Cluster.Spec.SSHAccess...)\n\tfor _, cidr := range sshAllowedCIDRs {\n\t\t// Allow incoming SSH traffic to the NLB\n\t\t// TODO: Could we get away without an NLB here?  Tricky to fix if dns-controller breaks though...","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/awsmodel/bastion.go#L197-L233","documentation":"While assigning the bastion load balancer to subnets, the builder iterates cluster subnets and only understands types Public, Private, DualStack and Utility. A subnet whose spec.networking.subnets[].type is anything else aborts the build with this error. It is a per-subnet enum validation guard.","triggerScenarios":"`kops update cluster` with a bastion configured where any cluster subnet has type set to an unrecognized value (typo like \"pubic\", \"internal\", or empty), so it falls through the switch's default branch.","commonSituations":"Hand-edited cluster specs, copy-pasted subnet blocks from other providers/docs, migration from very old kops versions whose subnet type vocabulary changed, or templating that interpolates an unset variable into the type field.","solutions":["Set every spec.networking.subnets[].type to one of: public, private, dualstack, utility","Remove or fix the offending subnet entry reported by name in the error message","If the subnet is only for utilities, explicitly set type: utility"],"exampleFix":"// before (cluster.yaml)\nsubnets:\n- name: aws-main\n  type: pubic\n  zone: us-east-1a\n// after\nsubnets:\n- name: aws-main\n  type: public\n  zone: us-east-1a","handlingStrategy":"validation","validationCode":"valid := map[kops.SubnetType]bool{kops.SubnetTypePublic: true, kops.SubnetTypePrivate: true, kops.SubnetTypeUtility: true, kops.SubnetTypeDualStack: true}\nfor _, s := range cluster.Spec.Networking.Subnets {\n    if !valid[s.Type] {\n        return fmt.Errorf(\"subnet %q has invalid type %q\", s.Name, s.Type)\n    }\n}","typeGuard":"func knownSubnetType(t kops.SubnetType) bool {\n    switch t {\n    case kops.SubnetTypePublic, kops.SubnetTypePrivate, kops.SubnetTypeUtility, kops.SubnetTypeDualStack:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := buildModel(ctx); err != nil {\n    if strings.Contains(err.Error(), \"had unknown type\") {\n        return fmt.Errorf(\"fix spec.networking.subnets[].type (public|private|utility|dualstack): %w\", err)\n    }\n    return err\n}","preventionTips":["Keep subnet types within the documented enum: public, private, utility, dualstack","Copy subnet blocks carefully when renaming — verify the type field too","Run manifest linting/kops dry-run before update"],"tags":["kops","aws","subnet","config-validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}