kubernetes/kops · error

error listing subnets: %v

Error message

error listing subnets: %v

What it means

ListSubnets delegates enumeration to DescribeSubnets and wraps any failure in this error. It means the subnet listing pipeline failed before any subnet resources could be tracked. The inner error (from DescribeSubnets/DescribeSubnetsPaginator) is embedded via %v.

Source

Thrown at pkg/resources/aws/aws.go:760

	_, err := c.EC2().DeleteSubnet(ctx, request)
	if err != nil {
		if awsup.AWSErrorCode(err) == "InvalidSubnetID.NotFound" {
			klog.V(2).Infof("Got InvalidSubnetID.NotFound error deleting subnet %q; will treat as already-deleted", id)
			return nil
		} else if IsDependencyViolation(err) {
			return err
		}
		return fmt.Errorf("error deleting Subnet %q: %v", id, err)
	}
	return nil
}

func ListSubnets(cloud fi.Cloud, vpcID, clusterName string) ([]*resources.Resource, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)
	subnets, err := DescribeSubnets(cloud)
	if err != nil {
		return nil, fmt.Errorf("error listing subnets: %v", err)
	}

	var resourceTrackers []*resources.Resource
	elasticIPs := sets.NewString()
	ownedElasticIPs := sets.NewString()
	natGatewayIds := sets.NewString()
	ownedNatGatewayIds := sets.NewString()
	for _, subnet := range subnets {
		subnetID := aws.ToString(subnet.SubnetId)

		shared := HasSharedTag("subnet:"+subnetID, subnet.Tags, clusterName)
		resourceTracker := &resources.Resource{
			Name:    FindName(subnet.Tags),
			ID:      subnetID,
			Type:    string(ec2types.ResourceTypeSubnet),
			Deleter: DeleteSubnet,
			Dumper:  DumpSubnet,
			Shared:  shared,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the inner error; grant ec2:DescribeSubnets if it's an authorization failure.
2. Fix credentials/region configuration (aws sts get-caller-identity to validate).
3. Retry with exponential backoff on throttling errors.
4. Verify connectivity to the regional EC2 endpoint.

if _, err := stsClient.GetCallerIdentity(ctx, &sts.GetCallerIdentityInput{}); err != nil { return fmt.Errorf("invalid AWS session: %w", err) }

func isAuthError(err error) bool { var ae smithy.APIError; return errors.As(err, &ae) && (ae.ErrorCode() == "UnauthorizedOperation" || ae.ErrorCode() == "AuthFailure" || ae.ErrorCode() == "AccessDenied") }

if err != nil {
  if isAuthError(err) { return fmt.Errorf("IAM missing ec2:DescribeSubnets: %w", err) }
  if isThrottling(err) { return backoffRetry() }
  return err
}

When it happens

Trigger: The underlying ec2:DescribeSubnets call fails: UnauthorizedOperation/AuthFailure, RequestLimitExceeded throttling, invalid credentials, or network/endpoint failure.

Common situations: IAM policy missing ec2:DescribeSubnets; expired credentials on long-lived CI jobs; EC2 throttling in busy accounts; misconfigured region (empty/wrong default).

Related errors

• error creating EgressOnlyInternetGateway: %v
• error creating VPCDHCPOptionsAssociation: %v
• error listing VPCs: %v
• error listing subnets in VPC %q: %v
• describing instance for arn %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e3829ac8009cf592. Report an issue: GitHub.