kubernetes/kops · error

error creating VPC: %v

Error message

error creating VPC: %v

What it means

RenderAWS creates a new VPC via EC2 CreateVpc when no actual VPC exists; if that API call fails, the error is wrapped with this message. The task cannot proceed because the VPC is the foundation for subnets, gateways, etc.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:206

				klog.Warningf("VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag")
			} else {
				// TODO: We could easily just allow kops to fix this...
				return fmt.Errorf("VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.", fi.ValueOf(e.ID))
			}
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating VPC with CIDR: %q", *e.CIDR)

		request := &ec2.CreateVpcInput{
			CidrBlock:         e.CIDR,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateVpc(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating VPC: %v", err)
		}

		e.ID = response.Vpc.VpcId
	}

	if changes.EnableDNSSupport != nil {
		request := &ec2.ModifyVpcAttributeInput{
			VpcId:            e.ID,
			EnableDnsSupport: &ec2types.AttributeBooleanValue{Value: changes.EnableDNSSupport},
		}

		_, err := t.Cloud.EC2().ModifyVpcAttribute(ctx, request)
		if err != nil {
			return fmt.Errorf("error modifying VPC attribute: %v", err)
		}
	}

	if changes.EnableDNSHostnames != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error: fix CIDR overlap or invalid range in cluster spec networkCIDR
2. Request a VPC quota increase or delete unused VPCs (error: VpcLimitExceeded)
3. Verify IAM permissions include ec2:CreateVpc (and CreateTags)
4. Retry if the cause was throttling (RequestLimitExceeded)

Example fix

// before: overlapping CIDR
networkCIDR: 10.0.0.0/16   # overlaps existing VPC
// after
networkCIDR: 10.1.0.0/16

// check CIDR doesn't overlap existing VPCs and quota headroom
vpcs, _ := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{})
if len(vpcs.Vpcs) >= vpcQuota { return errors.New("VPC quota exhausted") }

err := kopsApply()
var ae smithy.APIError
if errors.As(err, &ae) {
	switch ae.ErrorCode() {
	case "VpcLimitExceeded": requestQuotaIncrease()
	case "RequestLimitExceeded": retryWithBackoff()
	case "InvalidVpcID.NotFound", "InvalidCidrBlock": fixClusterSpecCIDR()
	}
}

When it happens

Trigger: CreateVpc rejected: invalid/too-large CIDR overlapping an existing VPC, CIDR outside allowed ranges, VPC limit reached (default 5), throttling, or IAM lacking ec2:CreateVpc.

Common situations: CIDR collides with a peered VPC; account hit the VPC quota; typo in networkCIDR in cluster spec; corporate SCP forbidding CreateVpc.

Related errors

• error associating Amazon IPv6 provided CIDR block to VPC: %v
• error deleting Subnet %q: %v
• error listing subnets: %v
• error detaching InternetGateway %q: %v
• VPC ID is required when EgressOnlyInternetGateway is shared

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/482d1b673bb0066c. Report an issue: GitHub.