cloud provider DigitalOcean requires the DOTerraform feature

Error message

cloud provider DigitalOcean requires the DOTerraform feature flag to enable the terraform target

What it means

Run() validates the terraform target against the selected cloud provider. DigitalOcean terraform support is gated behind the experimental DOTerraform feature flag; when the target is Terraform and the provider is DO and the flag is off, Run returns this error immediately. It is a deliberate opt-in guard, not a malfunction.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:172

}

func (c *ApplyClusterCmd) Run(ctx context.Context) (*ApplyResults, error) {
	if c.TargetName == TargetTerraform {
		found := false
		for _, cp := range TerraformCloudProviders {
			if c.Cloud.ProviderID() == cp {
				found = true
				break
			}
		}
		if !found {
			return nil, fmt.Errorf("cloud provider %v does not support the terraform target", c.Cloud.ProviderID())
		}
		if c.Cloud.ProviderID() == kops.CloudProviderAzure && !featureflag.AzureTerraform.Enabled() {
			return nil, fmt.Errorf("cloud provider Azure requires the AzureTerraform feature flag to enable the terraform target")
		}
		if c.Cloud.ProviderID() == kops.CloudProviderDO && !featureflag.DOTerraform.Enabled() {
			return nil, fmt.Errorf("cloud provider DigitalOcean requires the DOTerraform feature flag to enable the terraform target")
		}
	}
	if c.InstanceGroups == nil {
		list, err := c.Clientset.InstanceGroupsFor(c.Cluster).List(ctx, metav1.ListOptions{})
		if err != nil {
			return nil, err
		}
		var instanceGroups []*kops.InstanceGroup
		for i := range list.Items {
			instanceGroups = append(instanceGroups, &list.Items[i])
		}
		c.InstanceGroups = instanceGroups
	}

	if c.AdditionalObjects == nil {
		additionalObjects, err := c.Clientset.AddonsFor(c.Cluster).List(ctx)
		if err != nil {
			return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

Enable the flag: export KOPS_FEATURE_FLAGS=Doterraform (or add Doterraform to the existing feature flags list) and rerun the update.
Set the feature flag in the cluster spec: kops edit cluster and add 'Doterraform' under spec.featureFlags, then re-apply.
If terraform output is not actually required, use the default target instead of --target=terraform.

Example fix

// before
err := applyCluster.Run(ctx)
// after
os.Setenv("KOPS_FEATURE_FLAGS", "Doterraform")
// or in the cluster spec:
// spec:
//   featureFlags:
//     Doterraform: true

Defensive patterns

Strategy: validation

Validate before calling

if opts.Target == fi.TargetTerraform && cluster.Spec.CloudProvider == string(kops.CloudProviderDO) && !featureflag.DOTerraform.Enabled() {
    return fmt.Errorf("enable Doterraform feature flag before targeting terraform")
}

Prevention

Set KOPS_FEATURE_FLAGS=Doterraform in CI and dev shell profiles when working with DO clusters.
Document required feature flags next to the terraform export pipeline.
Validate target/provider combos in a preflight script before invoking kops.

When it happens

Trigger: Calling kops update cluster --target=terraform (or UpdateClusterOptions.Target=terraform) on a cluster whose spec sets cloudProvider=digitalocean while featureflag.DOTerraform is not enabled (no KOPS_FEATURE_FLAGS=Doterraform env var and no feature flag in the cluster spec).

Common situations: CI pipelines exporting DO clusters to terraform; teams switching an existing DO cluster from direct (TargetDirect) to terraform output for the first time; users upgrading kops to a version where DO terraform was gated behind the flag.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/99710f88a5d451b2. Report an issue: GitHub.