kubernetes/kops · error

error creating VPC

Error message

error creating VPC: %v

What it means

RenderAWS creates a new VPC via EC2 CreateVpc when no actual VPC exists; if that API call fails, the error is wrapped with this message. The task cannot proceed because the VPC is the foundation for subnets, gateways, etc.

Solutions

1. Check the wrapped AWS error: fix CIDR overlap or invalid range in cluster spec networkCIDR
2. Request a VPC quota increase or delete unused VPCs (error: VpcLimitExceeded)
3. Verify IAM permissions include ec2:CreateVpc (and CreateTags)
4. Retry if the cause was throttling (RequestLimitExceeded)

Example fix

// before: overlapping CIDR
networkCIDR: 10.0.0.0/16   # overlaps existing VPC
// after
networkCIDR: 10.1.0.0/16

// check CIDR doesn't overlap existing VPCs and quota headroom
vpcs, _ := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{})
if len(vpcs.Vpcs) >= vpcQuota { return errors.New("VPC quota exhausted") }

err := kopsApply()
var ae smithy.APIError
if errors.As(err, &ae) {
	switch ae.ErrorCode() {
	case "VpcLimitExceeded": requestQuotaIncrease()
	case "RequestLimitExceeded": retryWithBackoff()
	case "InvalidVpcID.NotFound", "InvalidCidrBlock": fixClusterSpecCIDR()
	}
}

When it happens

Trigger: CreateVpc rejected: invalid/too-large CIDR overlapping an existing VPC, CIDR outside allowed ranges, VPC limit reached (default 5), throttling, or IAM lacking ec2:CreateVpc.

Common situations: CIDR collides with a peered VPC; account hit the VPC quota; typo in networkCIDR in cluster spec; corporate SCP forbidding CreateVpc.

Related errors

• error associating Amazon IPv6 provided CIDR block to VPC
• CIDR block not found
• EgressOnlyInternetGateway for shared VPC was not found
• error associating AdditionalCIDR to VPC
• error attaching InternetGateway to VPC

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/482d1b673bb0066c. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:206

				klog.Warningf("VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag")
			} else {
				// TODO: We could easily just allow kops to fix this...
				return fmt.Errorf("VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.", fi.ValueOf(e.ID))
			}
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating VPC with CIDR: %q", *e.CIDR)

		request := &ec2.CreateVpcInput{
			CidrBlock:         e.CIDR,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateVpc(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating VPC: %v", err)
		}

		e.ID = response.Vpc.VpcId
	}

	if changes.EnableDNSSupport != nil {
		request := &ec2.ModifyVpcAttributeInput{
			VpcId:            e.ID,
			EnableDnsSupport: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSSupport},
		}

		_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)
		if err != nil {
			return fmt.Errorf("error modifying VPC attribute: %v", err)
		}
	}

	if changes.EnableDNSHostnames != nil {

View on GitHub (pinned to 4c8573c808)