kubernetes/kops · error

could not find subnet for Kubernetes API loadbalancer

Error message

could not find subnet for Kubernetes API loadbalancer

What it means

An explicit OpenStack load balancer is configured for the API, but no subnet of type Private (or DualStack) exists in spec.networking.subnets. The builder scans for the first private subnet to attach the LB to; finding none triggers this validation guard.

Source

Thrown at pkg/model/openstackmodel/servergroup.go:312

	for _, s := range sgs {
		c.AddTask(s)
	}

	if b.Cluster.Spec.CloudProvider.Openstack.Loadbalancer != nil {
		var lbSubnetName string
		var err error
		for _, sp := range b.Cluster.Spec.Networking.Subnets {
			if sp.Type == kops.SubnetTypeDualStack || sp.Type == kops.SubnetTypePrivate {
				lbSubnetName, err = b.findSubnetNameByID(sp.ID, sp.Name)
				if err != nil {
					return err
				}
				break
			}
		}
		if lbSubnetName == "" {
			return fmt.Errorf("could not find subnet for Kubernetes API loadbalancer")
		}

		lbTask := &openstacktasks.LB{
			Name:      new(b.APIResourceName()),
			Subnet:    new(lbSubnetName),
			Lifecycle: b.Lifecycle,
		}

		if b.Cluster.Spec.CloudProvider.Openstack.Loadbalancer.FlavorID != nil {
			lbTask.FlavorID = b.Cluster.Spec.CloudProvider.Openstack.Loadbalancer.FlavorID
		}

		useVIPACL := b.UseVIPACL()
		if !useVIPACL {
			lbTask.SecurityGroup = b.LinkToSecurityGroup(b.APIResourceName())
		}

		c.AddTask(lbTask)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add a private (or dual-stack) subnet to spec.networking.subnets
2. Remove cloudProvider.openstack.loadbalancer so the default LB placement is used
3. Verify existing subnets have the correct type field

When it happens

Trigger: Thrown at pkg/model/openstackmodel/servergroup.go:312 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/178f007338276d35. Report an issue: GitHub.