What causes "bastion supports --topology='private' only" in kubernetes/kops?

Remove the --bastion flag if you want public topology.

bastion supports --topology='private' only

Error message

bastion supports --topology='private' only

What it means

setupTopology configures public vs private topology. A bastion host exists to reach privately-topologized clusters, so requesting --bastion together with --topology=public is contradictory and rejected.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:1392

		if opt.IPv6 {
			opt.Topology = api.TopologyPrivate
		} else {
			opt.Topology = api.TopologyPublic
		}
	}

	cluster.Spec.Networking.Topology = &api.TopologySpec{}

	err := setupDNSTopology(opt, cluster)
	if err != nil {
		return nil, err
	}

	switch opt.Topology {
	case api.TopologyPublic:

		if opt.Bastion {
			return nil, fmt.Errorf("bastion supports --topology='private' only")
		}

		for i := range cluster.Spec.Networking.Subnets {
			cluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePublic
		}

	case api.TopologyPrivate:
		if cluster.Spec.Networking.Kubenet != nil {
			return nil, fmt.Errorf("invalid networking option %s. Kubenet does not support private topology", opt.Networking)
		}

		for i := range cluster.Spec.Networking.Subnets {
			cluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePrivate
		}

		var zoneToSubnetProviderID map[string]string
		var err error
		if len(opt.Zones) > 0 && len(opt.UtilitySubnetIDs) > 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

Remove the --bastion flag if you want public topology.
Switch to --topology private if you actually need a bastion.
In Go, set opt.Bastion=false when Topology is api.TopologyPublic.

Example fix

// before
kops create cluster my.cluster --topology public --bastion
// after
kops create cluster my.cluster --topology private --bastion

Defensive patterns

Strategy: validation

Validate before calling

[ "$TOPOLOGY" = "private" ] || [ -z "$BASTION" ] || { echo "--bastion requires --topology private"; exit 1; }

Try / catch

if err := createCluster(); err != nil && strings.Contains(err.Error(), "bastion supports") { /* drop --bastion or switch to private topology */ }

Prevention

Remember bastion implies private topology
Set topology and bastion flags together from one variable
Review cluster templates for stale --bastion flags

When it happens

Trigger: `kops create cluster --topology public --bastion` (or programmatic NewClusterOptions with Topology=public and Bastion=true) calls setupTopology from NewCluster and fails.

Common situations: Leaving --bastion in a script while changing topology to public; misunderstanding that a bastion requires private topology; defaults where Bastion=true remains set from a template.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ef090d345bdf65ff. Report an issue: GitHub.