kubernetes/kops · error

could not determine cluster region: no subnet specifies a zo

Error message

could not determine cluster region: no subnet specifies a zone

What it means

If none of the cluster's subnets specify a zone (all use subnet IDs instead, or are empty), FindRegion cannot infer a region from the spec alone and returns this error. The library requires at least one zone-based subnet to determine the region without additional cloud lookups. It prevents proceeding with an unknown region that would break S3 state-store and EC2 endpoint selection.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:117

				return "", fmt.Errorf("subnet %q must specify a zone or the ID of an existing subnet", subnet.Name)
			}
			continue
		}

		if len(subnet.Zone) <= 2 {
			return "", fmt.Errorf("invalid AWS zone: %q in subnet %q", subnet.Zone, subnet.Name)
		}

		zoneRegion := subnet.Zone[:len(subnet.Zone)-1]
		if region != "" && zoneRegion != region {
			return "", fmt.Errorf("error Clusters cannot span multiple regions (found zone %q, but region is %q)", subnet.Zone, region)
		}

		region = zoneRegion
	}

	if region == "" {
		return "", fmt.Errorf("could not determine cluster region: no subnet specifies a zone")
	}

	return region, nil
}

// SupportsS3BootstrapEndpoint reports whether the region uses the amazonaws.com partition DNS
// suffix hard-coded by the nodeup bootstrap script. EC2 uses the same partition suffix as S3 and
// can be resolved without a bucket.
func SupportsS3BootstrapEndpoint(ctx context.Context, region string) (bool, error) {
	resolver := ec2.NewDefaultEndpointResolverV2()
	endpoint, err := resolver.ResolveEndpoint(ctx, ec2.EndpointParameters{Region: aws.String(region)})
	if err != nil {
		return false, fmt.Errorf("resolving EC2 endpoint for region %q: %w", region, err)
	}

	return endpoint.URI.Hostname() == fmt.Sprintf("ec2.%s.amazonaws.com", region), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add at least one subnet with an explicit zone (e.g. zone: us-east-1a) to the cluster spec
2. Or set the region explicitly where supported / provide subnet IDs whose lookup path is used instead of FindRegion
3. Verify the subnets section is non-empty and populated after `kops edit cluster`

Example fix

// before
subnets:
- name: existing
  id: subnet-0abc123
// after
subnets:
- name: existing
  id: subnet-0abc123
  zone: us-east-1a

hasZone := false
for _, s := range cluster.Spec.Networking.Subnets {
    if s.Zone != "" { hasZone = true }
}
if !hasZone { return fmt.Errorf("at least one subnet must specify a zone") }

When it happens

Trigger: FindRegion finishing the subnet loop with region == "" — every subnet had an ID (zone deferred to cloud lookup) or the subnet list effectively carried no zones.

Common situations: Clusters defined entirely with existing subnet IDs; minimal test manifests with no zones; tooling that strips zone fields when importing a VPC.

Related errors

• subnet %q had unknown type %q
• subnet %q must specify a zone or the ID of an existing subne
• error Clusters cannot span multiple regions (found zone %q,
• getting AWS STS url: %w
• unhandled LoadBalancer type %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/85cceb4f18c32fdf. Report an issue: GitHub.