kubernetes/kops · error

error creating DHCPOptions: %v

Error message

error creating DHCPOptions: %v

What it means

kops wraps every raw AWS SDK failure from EC2 CreateDhcpOptions with this message while rendering the DHCPOptions task in RenderAWS (dhcp_options.go:166). It means the EC2 CreateDhcpOptions API call failed to create the DHCP options set (domain-name / domain-name-servers) for the VPC. The underlying AWS error is appended via %v, so the real cause (auth, limit, invalid value, region) is in the wrapped text.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dhcp_options.go:166

		}
		if e.DomainNameServers != nil {
			o := ec2types.NewDhcpConfiguration{
				Key:    aws.String("domain-name-servers"),
				Values: []string{aws.ToString(e.DomainNameServers)},
			}
			request.DhcpConfigurations = append(request.DhcpConfigurations, o)
		}
		if e.DomainName != nil {
			o := ec2types.NewDhcpConfiguration{
				Key:    aws.String("domain-name"),
				Values: []string{aws.ToString(e.DomainName)},
			}
			request.DhcpConfigurations = append(request.DhcpConfigurations, o)
		}

		response, err := t.Cloud.EC2().CreateDhcpOptions(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating DHCPOptions: %v", err)
		}

		e.ID = response.DhcpOptions.DhcpOptionsId
	}

	return t.AddAWSTags(*e.ID, e.Tags)
}

type terraformDHCPOptions struct {
	DomainName        *string           `cty:"domain_name"`
	DomainNameServers []string          `cty:"domain_name_servers"`
	Tags              map[string]string `cty:"tags"`
}

func (_ *DHCPOptions) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *DHCPOptions) error {
	tf := &terraformDHCPOptions{
		DomainName: e.DomainName,
		Tags:       e.Tags,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v text and fix the specific AWS error (InvalidParameterValue, LimitExceeded, UnauthorizedOperation, etc.)
2. If LimitExceeded: delete unused DHCP options sets in that region (EC2 console -> DHCP Options Sets)
3. If UnauthorizedOperation: grant ec2:CreateDhcpOptions and ec2:CreateTags to the kops IAM credentials
4. If InvalidParameterValue: correct the DomainName/DomainNameServers values in the cluster spec
5. Retry on throttling (RequestLimitExceeded) with backoff

Example fix

// before: kops IAM policy missing permission
{"Effect": "Deny", "Action": ["ec2:CreateDhcpOptions"]}
// after
{"Effect": "Allow", "Action": ["ec2:CreateDhcpOptions", "ec2:CreateTags"], "Resource": "*"}

// Pre-flight before creating DHCP options
import (
	"context"
	"fmt"
	"github.com/aws/aws-sdk-go-v2/service/ec2"
)

func canCreateDhcpOptions(ctx context.Context, c *ec2.Client) error {
	if c.Options().Region == "" {
		return fmt.Errorf("AWS region not set")
	}
	if _, err := c.DescribeDhcpOptions(ctx, &ec2.DescribeDhcpOptionsInput{}); err != nil {
		return fmt.Errorf("credentials cannot read EC2 (check perms/region): %w", err)
	}
	return nil
}

// Branch on the wrapped AWS error code
if err := task.RenderAWS(target, a, e, changes); err != nil {
	if strings.Contains(err.Error(), "LimitExceeded") {
		// delete unused DHCP options sets, then retry
	} else if strings.Contains(err.Error(), "UnauthorizedOperation") {
		// fix IAM: ec2:CreateDhcpOptions
	}
	return err
}

When it happens

Trigger: EC2 CreateDhcpOptions fails: invalid DhcpConfigurations values, exceeding the per-region DHCP options set quota, credentials lacking ec2:CreateDhcpOptions permission, throttling, or region/endpoint issues. Also triggered when the following AddAWSTags call fails after partial creation.

Common situations: Cluster creation in a new AWS account near the DHCP options set limit; IAM policy restricting ec2:CreateDhcpOptions; malformed custom domain-name-servers values in the cluster spec; API throttling during large cluster creates.

Related errors

• error deleting DhcpOptions %q: %v
• error listing DhcpOptions: %v
• error listing DHCPOptions: %v
• found multiple DhcpOptions with name: %s
• NAT EC2 Instance %q not found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/294b247a0e145027. Report an issue: GitHub.