kubernetes/kops · error

error listing VPCs: %v

Error message

error listing VPCs: %v

What it means

Returned by kops' FindVPC (upup/pkg/fi/cloudup/awsup/aws_cloud.go:1674) when the AWS SDK call ec2.DescribeVpcs fails while looking up a specific VPC by ID. It wraps the underlying AWS error, so the root cause (auth, networking, or a nonexistent/invalid VPC ID) is in the %v suffix.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_cloud.go:1674

	instance := reservation.Instances[0]
	return &instance, nil
}

// DescribeVPC is a helper that queries for the specified vpc by id
func (c *awsCloudImplementation) DescribeVPC(vpcID string) (*ec2types.Vpc, error) {
	return describeVPC(c, vpcID)
}

func describeVPC(c AWSCloud, vpcID string) (*ec2types.Vpc, error) {
	klog.V(2).Infof("Calling DescribeVPC for VPC %q", vpcID)
	ctx := context.TODO()
	request := &ec2.DescribeVpcsInput{
		VpcIds: []string{vpcID},
	}

	response, err := c.EC2().DescribeVpcs(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing VPCs: %v", err)
	}
	if response == nil || len(response.Vpcs) == 0 {
		return nil, nil
	}
	if len(response.Vpcs) != 1 {
		return nil, fmt.Errorf("found multiple VPCs for %q", vpcID)
	}

	vpc := response.Vpcs[0]
	return &vpc, nil
}

// ResolveImage finds an AMI image based on the given name.
// The name can be one of:
// `ami-...` in which case it is presumed to be an id
// owner/name in which case we find the image with the specified name, owned by owner
// name in which case we find the image with the specified name, with the current owner
func (c *awsCloudImplementation) ResolveImage(name string) (*ec2types.Image, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run `aws ec2 describe-vpcs --vpc-ids <id>` with the same credentials/region to reproduce the underlying error and check the wrapped message
2. Verify the VPC ID in the kops cluster spec exists in the target region (`kops get cluster -oyaml` and compare with AWS console)
3. Fix AWS credentials/environment (AWS_PROFILE, AWS_REGION, instance role) before retrying
4. Confirm the VPC was not deleted; recreate it or update the cluster spec

Example fix

// before
cluster.Spec.NetworkID = "vpc-0123456789abcdef"
// after
// confirm the ID exists first:
// aws ec2 describe-vpcs --vpc-ids vpc-0123456789abcdef --region us-east-1
cluster.Spec.NetworkID = "vpc-0abc123de4567890f"

// Pre-flight: ensure the VPC exists and is reachable before calling kops
out, err := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
if err != nil { return fmt.Errorf("preflight VPC check failed: %w", err) }
if len(out.Vpcs) == 0 { return fmt.Errorf("VPC %s does not exist in this region", vpcID) }

func vpcExists(out *ec2.DescribeVpcsOutput, id string) bool {
	return out != nil && len(out.Vpcs) == 1 && aws.ToString(out.Vpcs[0].VpcId) == id
}

vpc, err := cloud.FindVPC(ctx, vpcID)
if err != nil {
	if strings.Contains(err.Error(), "InvalidVpcID.NotFound") {
		// fall back to default VPC or abort with a clear message
	}
	return err
}

When it happens

Trigger: DescribeVpcs is called with a VpcIds filter of [vpcID] and AWS returns an error: invalid credentials, invalid VPC ID format, VPC deleted, region mismatch, or API throttling/network failure.

Common situations: Typo in cluster spec vpcID; cluster config references a VPC in a different region than the client; AWS session credentials expired or missing; VPC deleted by another process after being referenced in the kops cluster spec.

Related errors

• error listing subnets: %v
• error creating EgressOnlyInternetGateway: %v
• error creating VPCDHCPOptionsAssociation: %v
• describing instance for arn %q
• error terminating instances: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/518f0bb5c4264a4c. Report an issue: GitHub.