cloud provider Azure requires the AzureTerraform feature fla

Error message

cloud provider Azure requires the AzureTerraform feature flag to enable the terraform target

What it means

Even for supported providers, Run gates provider-specific terraform support behind feature flags: Azure requires featureflag.AzureTerraform and DigitalOcean requires featureflag.DOTerraform. When the flag is off, Run returns 'cloud provider Azure requires the AzureTerraform feature flag to enable the terraform target'.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:169

type ApplyResults struct {
	// AssetBuilder holds the initialized AssetBuilder, listing all the image and file assets.
	AssetBuilder *assets.AssetBuilder
}

func (c *ApplyClusterCmd) Run(ctx context.Context) (*ApplyResults, error) {
	if c.TargetName == TargetTerraform {
		found := false
		for _, cp := range TerraformCloudProviders {
			if c.Cloud.ProviderID() == cp {
				found = true
				break
			}
		}
		if !found {
			return nil, fmt.Errorf("cloud provider %v does not support the terraform target", c.Cloud.ProviderID())
		}
		if c.Cloud.ProviderID() == kops.CloudProviderAzure && !featureflag.AzureTerraform.Enabled() {
			return nil, fmt.Errorf("cloud provider Azure requires the AzureTerraform feature flag to enable the terraform target")
		}
		if c.Cloud.ProviderID() == kops.CloudProviderDO && !featureflag.DOTerraform.Enabled() {
			return nil, fmt.Errorf("cloud provider DigitalOcean requires the DOTerraform feature flag to enable the terraform target")
		}
	}
	if c.InstanceGroups == nil {
		list, err := c.Clientset.InstanceGroupsFor(c.Cluster).List(ctx, metav1.ListOptions{})
		if err != nil {
			return nil, err
		}
		var instanceGroups []*kops.InstanceGroup
		for i := range list.Items {
			instanceGroups = append(instanceGroups, &list.Items[i])
		}
		c.InstanceGroups = instanceGroups
	}

	if c.AdditionalObjects == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Enable the flag: `export KOPS_FEATURE_FLAGS=AzureTerraform` before running kops
Combine with other flags if needed: `KOPS_FEATURE_FLAGS=AzureTerraform,Spotinst`
Verify the flag is exported in CI (print env in the pipeline step)
Use --target=direct if terraform output is not strictly required

Example fix

// before
kops update cluster azure-cluster --target=terraform --yes
// after
export KOPS_FEATURE_FLAGS=AzureTerraform
kops update cluster azure-cluster --target=terraform --yes

Defensive patterns

Strategy: validation

Validate before calling

// gate on the flag before running terraform target
if provider == "azure" && !featureflag.AzureTerraform.Enabled() {
	return errors.New("set KOPS_FEATURE_FLAGS=AzureTerraform first")
}

Try / catch

out, err := run("kops", "update", "cluster", "--target=terraform", "--yes")
if err != nil && strings.Contains(err.Error(), "AzureTerraform feature flag") {
	os.Setenv("KOPS_FEATURE_FLAGS", "AzureTerraform")
	return run("kops", "update", "cluster", "--target=terraform", "--yes")
}

Prevention

Export KOPS_FEATURE_FLAGS=AzureTerraform (or DOTerraform) in shell profiles and CI
Terraform targets for Azure/DO are gated alpha features — expect flag requirements
Print KOPS_FEATURE_FLAGS in CI logs to debug flag propagation
Enable the flag in every environment that runs the terraform target

When it happens

Trigger: `kops update cluster --target=terraform` against an Azure cluster without KOPS_FEATURE_FLAGS containing AzureTerraform. Equivalent DO case triggers the sibling DOTerraform error.

Common situations: CI/CD pipelines generating terraform for Azure clusters after upgrading kOps where the flag became required; developers unaware the feature is alpha/behind a flag; env var set only in interactive shells but not in the pipeline.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/76dbb9b1f5e06e5b. Report an issue: GitHub.