{"record":{"id":"ffe27daacbcb89e6","repo":"kubernetes/kops","slug":"vpc-with-id-q-was-set-to-be-shared-but-did-not-h","errorCode":null,"errorMessage":"VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.","messagePattern":"VPC with id %q was set to be shared, but did not have EnableDNSSupport=true\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc.go","lineNumber":191,"sourceCode":"func (e *VPC) Run(c *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(e, c)\n}\n\nfunc (_ *VPC) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPC) error {\n\tctx := context.TODO()\n\tshared := fi.ValueOf(e.Shared)\n\tif shared {\n\t\t// Verify the VPC was found and matches our required settings\n\t\tif a == nil {\n\t\t\treturn fmt.Errorf(\"VPC with id %q not found\", fi.ValueOf(e.ID))\n\t\t}\n\n\t\tif changes != nil && changes.EnableDNSSupport != nil {\n\t\t\tif featureflag.VPCSkipEnableDNSSupport.Enabled() {\n\t\t\t\tklog.Warningf(\"VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag\")\n\t\t\t} else {\n\t\t\t\t// TODO: We could easily just allow kops to fix this...\n\t\t\t\treturn fmt.Errorf(\"VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.\", fi.ValueOf(e.ID))\n\t\t\t}\n\t\t}\n\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating VPC with CIDR: %q\", *e.CIDR)\n\n\t\trequest := &ec2.CreateVpcInput{\n\t\t\tCidrBlock:         e.CIDR,\n\t\t\tTagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),\n\t\t}\n\n\t\tresponse, err := t.Cloud.EC2().CreateVpc(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating VPC: %v\", err)\n\t\t}\n\n\t\te.ID = response.Vpc.VpcId","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc.go#L173-L209","documentation":"For a shared VPC, kOps requires EnableDNSSupport=true because cluster DNS and internal name resolution depend on it. If changes show EnableDNSSupport needs to be enabled but the VPCSkipEnableDNSSupport feature flag is off, RenderAWS refuses to proceed with this error.","triggerScenarios":"Shared VPC has EnableDNSSupport=false and the apply computes a change to enable it; feature flag VPCSkipEnableDNSSupport not enabled, so the preflight check fails.","commonSituations":"Reusing a corporate VPC where DNS hostnames/support were never enabled; org policy disabling VPC DNS settings; upgrading an older cluster spec onto a newly shared VPC.","solutions":["Enable DNS support on the VPC: `aws ec2 modify-vpc-attribute --vpc-id <id> --enable-dns-support`","Or set the feature flag to skip: `export KOPS_FEATURE_FLAGS=VPCSkipEnableDNSSupport` (not recommended; DNS will break)","Or run `kops edit cluster` and point to a VPC with DNS support enabled"],"exampleFix":"// before\naws ec2 describe-vpc-attribute --vpc-id vpc-x --attribute enableDnsSupport  # false\n// after\naws ec2 modify-vpc-attribute --vpc-id vpc-x --enable-dns-support '{\"Value\":true}'","handlingStrategy":"validation","validationCode":"out, _ := ec2Client.DescribeVpcAttribute(ctx, &ec2.DescribeVpcAttributeInput{VpcId: vpcID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport})\nif out != nil && !fi.ValueOf(out.EnableDnsSupport) {\n\treturn fmt.Errorf(\"shared VPC %s must have EnableDNSSupport=true before apply\", vpcID)\n}","typeGuard":null,"tryCatchPattern":"err := kopsUpdateCluster()\nif err != nil && strings.Contains(err.Error(), \"EnableDNSSupport=true\") {\n\t// remediate: enable DNS support on the VPC, then retry\n}","preventionTips":["Enable DNS support+hostnames on any VPC before sharing it with kOps","Check VPC attributes during VPC onboarding review","Only use VPCSkipEnableDNSSupport with a full understanding DNS will break","Document VPC prerequisites for teams sharing network accounts"],"tags":["aws","vpc","dns","shared-vpc","feature-flag"],"backgroundTag":"vpc-dns-support-disabled","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}