kubernetes/kops · error

error describing Network: %v

Error message

error describing Network: %v

What it means

After authenticating, the OpenStack client's FindVPCInfo(cluster.Spec.Networking.NetworkID) queries Neutron for the network and its subnets. If the Neutron API call fails (authorization, timeout, quota, service outage), the SDK error is wrapped as "error describing Network: %v" and returned, aborting cluster creation.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:945

		if res[subnet.Zone] != "" {
			return res, fmt.Errorf("subnet %s and %s have the same zone", subnetID, res[subnet.Zone])
		}
		res[subnet.Zone] = subnetID
	}
	return res, nil
}

func getOpenstackZoneToSubnetProviderID(cluster *api.Cluster, zones []string, subnetIDs []string) (map[string]string, error) {
	res := make(map[string]string)
	osCloud, err := openstack.NewOpenstackCloud(cluster, "new-cluster-zone-to-subnet")
	if err != nil {
		return res, fmt.Errorf("error loading cloud: %v", err)
	}
	osCloud.UseZones(zones)

	networkInfo, err := osCloud.FindVPCInfo(cluster.Spec.Networking.NetworkID)
	if err != nil {
		return res, fmt.Errorf("error describing Network: %v", err)
	}
	if networkInfo == nil {
		return res, fmt.Errorf("network %q not found", cluster.Spec.Networking.NetworkID)
	}

	subnetByID := make(map[string]*fi.SubnetInfo)
	for _, subnetInfo := range networkInfo.Subnets {
		subnetByID[subnetInfo.ID] = subnetInfo
	}

	for _, subnetID := range subnetIDs {
		subnet, ok := subnetByID[subnetID]
		if !ok {
			return res, fmt.Errorf("subnet %s not found in network %s", subnetID, cluster.Spec.Networking.NetworkID)
		}

		if res[subnet.Zone] != "" {
			return res, fmt.Errorf("subnet %s and %s have the same zone", subnetID, res[subnet.Zone])

View on GitHub (pinned to 4c8573c808)

Solutions

1. Test with the CLI: `openstack network show <network-id>` — fix policy/RBAC if it 403s.
2. Re-authenticate if the token expired and rerun kOps.
3. Verify the network ID exists and is visible to your project; use the correct --os-network value.
4. Retry during Neutron outages; check the cloud provider's status page.

Example fix

// before (project lacks RBAC on shared network)
kops create cluster --cloud openstack --os-network shared-net-uuid ...
// after
# as cloud admin, add RBAC allowing the project to access the network, then rerun
openstack network rbac create --type network --target-project <project-id> --action access_as_shared shared-net-uuid

if err := exec.Command("openstack", "network", "show", networkID).Run(); err != nil {
    return fmt.Errorf("cannot query network %s: %w", networkID, err)
}

if strings.Contains(err.Error(), "error describing Network") {
    if isTransient(err) { backoffAndRetry() } else { // fix Neutron RBAC or re-auth and retry once re-authenticated }
}

When it happens

Trigger: `kops create cluster --cloud openstack --os-network <network-id> ...` where listing network/subnets via Neutron errors: policy denying get_network/get_subnet for the project, Neutron endpoint unreachable, token expiry mid-run, or malformed network ID causing API errors.

Common situations: Projects with restricted Neutron RBAC policies; shared-provider networks invisible to the caller; Neutron service degraded in the cloud region; short-lived tokens expiring during long-running commands.

Related errors

• network %q not found
• error listing subnets in network %q: %v
• could not list ports %v
• error retrieving network with id %s: %v
• error listing networks: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a8c32f97fcc90013. Report an issue: GitHub.