kubernetes/kops · error

error creating VPCDHCPOptionsAssociation: %v

Error message

error creating VPCDHCPOptionsAssociation: %v

What it means

RenderAWS for VPCDHCPOptionsAssociation calls EC2 AssociateDhcpOptions to bind a DHCP options set to a VPC; failures are wrapped with this message. Without the association the VPC lacks DNS servers/domain settings needed by the cluster.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc_dhcpoptions_association.go:99

			return fi.CannotChangeField("VPC")
		}
	}

	return nil
}

func (_ *VPCDHCPOptionsAssociation) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPCDHCPOptionsAssociation) error {
	ctx := context.TODO()
	if changes.DHCPOptions != nil {
		klog.V(2).Infof("calling EC2 AssociateDhcpOptions")
		request := &ec2.AssociateDhcpOptionsInput{
			VpcId:         e.VPC.ID,
			DhcpOptionsId: e.DHCPOptions.ID,
		}

		_, err := t.Cloud.EC2().AssociateDhcpOptions(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating VPCDHCPOptionsAssociation: %v", err)
		}
	}

	return nil // no tags
}

type terraformVPCDHCPOptionsAssociation struct {
	VPCID         *terraformWriter.Literal `cty:"vpc_id"`
	DHCPOptionsID *terraformWriter.Literal `cty:"dhcp_options_id"`
}

func (_ *VPCDHCPOptionsAssociation) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *VPCDHCPOptionsAssociation) error {
	tf := &terraformVPCDHCPOptionsAssociation{
		VPCID:         e.VPC.TerraformLink(),
		DHCPOptionsID: e.DHCPOptions.TerraformLink(),
	}

	return t.RenderResource("aws_vpc_dhcp_options_association", *e.Name, tf)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify both IDs exist in the same region: `aws ec2 describe-dhcp-options` / `describe-vpcs`
2. Ensure IAM allows ec2:AssociateDhcpOptions
3. Re-run apply if throttled (RequestLimitExceeded)
4. If IDs were hand-edited, regenerate the spec with kops

Example fix

// before: options set in wrong region
DhcpOptionsId: dopt-from-us-east-1  # cluster in us-west-2
// after
DhcpOptionsId: dopt-in-us-west-2

opts, err := ec2Client.DescribeDhcpOptions(ctx, &ec2.DescribeDhcpOptionsInput{DhcpOptionsIds: []string{doptID}})
if err != nil || len(opts.DhcpOptions) == 0 { return fmt.Errorf("DHCP options %s missing in region", doptID) }

err := kopsApply()
var ae smithy.APIError
if errors.As(err, &ae) {
	if ae.ErrorCode() == "RequestLimitExceeded" { retryWithBackoff() }
	if strings.HasPrefix(ae.ErrorCode(), "Invalid") { verifyIDsAndRegion() }
}

When it happens

Trigger: AssociateDhcpOptions fails: referenced DhcpOptionsId or VpcId doesn't exist (wrong region/account), invalid ID format, throttling, or IAM lacking ec2:AssociateDhcpOptions.

Common situations: Cross-region mismatch between VPC and DHCP options set; options set deleted manually; shared VPC with restricted IAM; typo in IDs in the state/spec.

Related errors

• error listing subnets: %v
• error creating EgressOnlyInternetGateway: %v
• error listing VPCs: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/24414ce5e58c848e. Report an issue: GitHub.