kubernetes/kops · error

could not determine any subnets for InstanceGroup %q; subnet

Error message

could not determine any subnets for InstanceGroup %q; subnets was %s

What it means

buildAutoScalingGroupTask resolves the subnets for the instance group via GatherSubnets; after resolution it guards that at least one subnet was found. If the group's subnet references resolve to zero subnet objects, the ASG task cannot be placed in any VPC and Build fails with this message, echoing the raw spec.subnets list.

Source

Thrown at pkg/model/awsmodel/autoscalinggroup.go:461

		minSize = new(int32(*ig.Spec.MinSize))
	} else if ig.Spec.Role.HasNode() {
		minSize = new(int32(2))
	}
	if ig.Spec.MaxSize != nil {
		maxSize = new(int32(*ig.Spec.MaxSize))
	} else if ig.Spec.Role.HasNode() {
		maxSize = new(int32(2))
	}

	t.MinSize = minSize
	t.MaxSize = maxSize

	subnets, err := b.GatherSubnets(ig)
	if err != nil {
		return nil, err
	}
	if len(subnets) == 0 {
		return nil, fmt.Errorf("could not determine any subnets for InstanceGroup %q; subnets was %s", ig.ObjectMeta.Name, ig.Spec.Subnets)
	}
	for _, subnet := range subnets {
		t.Subnets = append(t.Subnets, b.LinkToSubnet(subnet))
	}

	tags, err := b.CloudTagsForInstanceGroup(ig)
	if err != nil {
		return nil, fmt.Errorf("error building cloud tags: %v", err)
	}
	t.Tags = tags

	processes := []string{}
	processes = append(processes, ig.Spec.SuspendProcesses...)
	t.SuspendProcesses = &processes

	if ig.Spec.InstanceProtection != nil {
		t.InstanceProtection = ig.Spec.InstanceProtection
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `kops get cluster -oyaml` and cross-check every name in the instance group's spec.subnets against the cluster's spec.networking.subnets names — fix typos or add the missing subnet to the cluster spec.
2. Ensure each instance group's subnets include at least one subnet whose name matches a cluster subnet entry with a valid zone and cidr.
3. If subnets were removed intentionally, update the instance group: `kops edit instancegroup <ig>` and set reachable subnets, then `kops update cluster`.
4. For new zones, first add the subnet to the cluster spec (with zone/cidr) before referencing it from an instance group.

Example fix

// before (instancegroup.yaml)
metadata:
  name: nodes
spec:
  subnets: ["us-east-1b-private"]  # not defined in cluster
// after
spec:
  subnets: ["us-east-1a-private"]  # matches cluster spec subnet name

# ensure every instance-group subnet exists in the cluster spec
cluster_subnets=$(kops get cluster -oyaml | yq '.spec.networking.subnets[].name' | sort)
for ig in $(kops get ig -oname); do
  for s in $(kops get ig "$ig" -oyaml | yq '.spec.subnets[]'); do
    echo "$cluster_subnets" | grep -qx "$s" || { echo "$ig references unknown subnet: $s"; exit 1; }
  done
done

When it happens

Trigger: `kops update cluster` when spec.instanceGroup.spec.subnets lists names that don't exist in spec.networking / cluster subnets, the subnets list is empty, or a subnet is defined only in a zone/utility allocation that GatherSubnets filters out (e.g. referencing a subnet name that maps to no CIDR/zone).

Common situations: Typo'd subnet names in the instance group vs cluster spec; instance group moved to a zone with no matching subnet; cluster.yaml edited after removing a subnet from the cluster spec but leaving it on instance groups; trying to place a master/node IG only in utility subnets.

Related errors

• control-plane InstanceGroup %s did not specify any Subnets
• ErrAlreadyExists
• DeviceName not set for volume
• error populating configuration: %v
• error initializing AWS client: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b9b91c570486c288. Report an issue: GitHub.