What causes "could not find Image for %q" in kubernetes/kops?

List what actually matches: `aws ec2 describe-images --filters Name=name,Values= ` in the target region

could not find Image for %q

Error message

could not find Image for %q

What it means

Returned by resolveImage (aws_cloud.go:1765) when DescribeImages succeeded (no pages errored) but no image matched the requested name/owner filters. kops keeps the newest candidate among matches, and zero matches yields this error.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1765

		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("error listing images: %v", err)
		}

		for _, v := range page.Images {
			if image == nil {
				image = &v
			} else {
				itime, _ := time.Parse(time.RFC3339, *image.CreationDate)
				vtime, _ := time.Parse(time.RFC3339, *v.CreationDate)
				if vtime.After(itime) {
					image = &v
				}
			}
		}
	}
	if image == nil {
		return nil, fmt.Errorf("could not find Image for %q", name)
	}

	klog.V(4).Infof("Resolved image %q", aws.ToString(image.ImageId))
	return image, nil
}

// ResolveImageOwnerAlias maps a well-known image owner alias (e.g. "ubuntu") to its
// AWS account ID. Unrecognized owners are returned unchanged.
func ResolveImageOwnerAlias(owner string) string {
	switch owner {
	case "amazon", "amazon.com":
		return WellKnownAccountAmazonLinux2023
	case "debian", "debian11":
		return WellKnownAccountDebian
	case "flatcar":
		return WellKnownAccountFlatcar
	case "redhat", "redhat.com":
		return WellKnownAccountRedhat

View on GitHub (pinned to 4c8573c808)

Solutions

List what actually matches: `aws ec2 describe-images --filters Name=name,Values=<name>` in the target region
If empty, the image is not available there — pick a region-correct name or resolve to an explicit AMI ID
For private AMIs, share the image with the account or use the AMI owner's account credentials
Update the pinned image name to a currently published one (upstream names change with releases)

Example fix

// before
image: "ubuntu-jammy-22.04-amd64-server-20230101"  # no longer published
// after
image: "ami-0abcdef1234567890"  # resolved via aws ec2 describe-images

Defensive patterns

Strategy: fallback

Validate before calling

// Verify the image resolves before using it in a spec
out, err := ec2Client.DescribeImages(ctx, &ec2.DescribeImagesInput{
	Owners: []string{owner},
	Filters: []ec2types.Filter{ec2filter("name", imageName)},
})
if err == nil && len(out.Images) == 0 { return fmt.Errorf("image %q not found in region %s", imageName, region) }

Try / catch

img, err := resolveImage(ctx, ssmClient, ec2Client, name)
if err != nil {
	if strings.Contains(err.Error(), "could not find Image") {
		return fallbackToDefaultAMI(region) // or abort with a clear message
	}
	return err
}

Prevention

Confirm image availability per-region — names differ or may be absent across regions
For private AMIs, verify they are shared with the calling account
Re-check pinned image names after upstream releases; prefer SSM-published parameters or explicit AMI IDs

When it happens

Trigger: The DescribeImages paginator returns pages whose Images slices contain no entry matching the filter — wrong name string, image not shared with this account, image absent in this region, or the owner filter excludes it.

Common situations: Pinning an AMI name that the upstream project no longer publishes; using a name published only in a different region; referencing a private AMI not shared with the account; typo in the image name in the cluster spec.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/966a7f8e186acf74. Report an issue: GitHub.