kubernetes/kops · error

error waiting for Subnet patch to complete: %w

Error message

error waiting for Subnet patch to complete: %w

What it means

This error wraps the failure returned by GCE's WaitForOp while polling the operation produced by Subnetworks().Patch on a subnet. kOps patches the subnet (e.g. to update secondary ranges) and then waits for the long-running GCE operation to finish; if that wait fails or the operation ends in an error state, this error is returned. The underlying GCE error is preserved via %w.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/subnet.go:246

			return nil
		}

		subnet.SecondaryIpRanges = nil
		for k, v := range expectedRanges {
			subnet.SecondaryIpRanges = append(subnet.SecondaryIpRanges, &compute.SubnetworkSecondaryRange{
				RangeName:   k,
				IpCidrRange: v,
			})
		}
	}

	patchOp, err := cloud.Compute().Subnetworks().Patch(cloud.Project(), cloud.Region(), subnet.Name, subnet)
	if err != nil {
		return fmt.Errorf("error patching Subnet: %w", err)
	}

	if err := cloud.WaitForOp(patchOp); err != nil {
		return fmt.Errorf("error waiting for Subnet patch to complete: %w", err)
	}

	return nil
}

func updateStackTypeAndIPv6AccessType(cloud gce.GCECloud, e *Subnet) error {
	// We need to refetch to patch it
	subnet, err := cloud.Compute().Subnetworks().Get(cloud.Project(), cloud.Region(), *e.Name)
	if err != nil {
		return fmt.Errorf("error fetching subnet for patch: %w", err)
	}

	subnet.StackType = fi.ValueOf(e.StackType)
	subnet.Ipv6AccessType = fi.ValueOf(e.Ipv6AccessType)

	patchOp, err := cloud.Compute().Subnetworks().Patch(cloud.Project(), cloud.Region(), subnet.Name, subnet)
	if err != nil {
		return fmt.Errorf("error patching Subnet: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %w cause (run with -v=10) to see the GCE operation error detail
2. Verify the new secondary range CIDRs don't overlap existing ranges or fall outside allowed allocations in the GCP console
3. Check the subnet is not in use (VMs, forwarding rules, routers) before changing ranges
4. Retry `kops update cluster` after resolving the GCP-side issue; transient API failures often resolve
5. Verify project quota and region capacity for IP ranges

Example fix

// before (kops side, diagnostic)
return fmt.Errorf("error waiting for Subnet patch to complete: %w", err)
// after
return fmt.Errorf("error waiting for Subnet patch to complete (check GCE operation logs for subnet %s): %w", subnet.Name, err)

gcloud compute networks subnets describe <subnet> --region <region> --format='value(secondaryIpRanges)'

var waitErr *GceOperationError
if errors.As(err, &waitErr) { /* inspect waitErr.Operation for GCE detail before retrying */ }

When it happens

Trigger: updateSecondaryRanges calls Compute().Subnetworks().Patch(project, region, subnet.Name, subnet) and then cloud.WaitForOp(patchOp); the wait fails because the GCE patch operation completed with an error (e.g. quota, invalid secondary range config) or the polling API call itself errored.

Common situations: Changing subnet secondary CIDR ranges to values that conflict with existing ranges or exceed GCP limits; subnets already in use by instances/routers preventing modification; transient GCP API outages during `kops update cluster`; project-level quota exhaustion.

Related errors

• error listing subnetworks: %v
• creating gce IPAM controller: %w
• error building compute API client: %v
• failed to parse subnet CIDR %q: %w
• error listing zones: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/057560e2e123f4d8. Report an issue: GitHub.