kubernetes/kops · error

found multiple public subnets in zone: %q

Error message

found multiple public subnets in zone: %q

What it means

The same helper, LinkToPublicSubnetInZone, requires exactly one public subnet per zone; if two or more subnet specs in the same zone have type "public", it refuses to pick arbitrarily and returns this error. The limitation is explicit in the code (TODO: support multiple, arbitrary choice for ELBs).

Source

Thrown at pkg/model/awsmodel/context.go:55

func (b *AWSModelContext) LinkToPublicSubnetInZone(zoneName string) (*awstasks.Subnet, error) {
	var matches []*kops.ClusterSubnetSpec
	for i := range b.Cluster.Spec.Networking.Subnets {
		z := &b.Cluster.Spec.Networking.Subnets[i]
		if z.Zone != zoneName {
			continue
		}
		if z.Type != kops.SubnetTypePublic {
			continue
		}
		matches = append(matches, z)
	}
	if len(matches) == 0 {
		return nil, fmt.Errorf("could not find public subnet in zone: %q", zoneName)
	}
	if len(matches) > 1 {
		// TODO: Support this (arbitrary choice I think, for ELBs)
		return nil, fmt.Errorf("found multiple public subnets in zone: %q", zoneName)
	}

	return b.LinkToSubnet(matches[0]), nil
}

func (b *AWSModelContext) LinkToUtilitySubnetInZone(zoneName string) (*awstasks.Subnet, error) {
	var matches []*kops.ClusterSubnetSpec
	for i := range b.Cluster.Spec.Networking.Subnets {
		s := &b.Cluster.Spec.Networking.Subnets[i]
		if s.Zone != zoneName {
			continue
		}
		if s.Type != kops.SubnetTypeUtility {
			continue
		}
		matches = append(matches, s)
	}
	if len(matches) == 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove the duplicate public subnet entry for that zone, keeping exactly one
2. Merge the needed CIDR into the existing public subnet instead of adding a second public subnet in the same AZ
3. Give the second subnet a distinct type (only if it is genuinely not public/internet-facing) or move it to another zone

Example fix

// before (cluster.yaml)
subnets:
- name: public-a-1
  type: public
  zone: us-east-1a
- name: public-a-2
  type: public
  zone: us-east-1a
// after
subnets:
- name: public-a-1
  type: public
  zone: us-east-1a

counts := map[string]int{}
for _, s := range cluster.Spec.Networking.Subnets {
    if s.Type == kops.SubnetTypePublic {
        counts[s.Zone]++
    }
}
for zone, n := range counts {
    if n > 1 {
        return fmt.Errorf("zone %q has %d public subnets; exactly one is required", zone, n)
    }
}

subnet, err := b.LinkToPublicSubnetInZone(zone)
if err != nil {
    if strings.Contains(err.Error(), "found multiple public subnets in zone") {
        return fmt.Errorf("keep exactly one public subnet per zone %q: %w", zone, err)
    }
    return err
}

When it happens

Trigger: Cluster spec defines two or more spec.networking.subnets entries with type: public sharing the same zone value (e.g. two CIDRs in one AZ for expansion), then any model build that calls LinkToPublicSubnetInZone for that zone fails.

Common situations: Users adding extra public subnets to an AZ for more IP space, copied-and-renamed subnet blocks where the zone was left unchanged, or automation scaling out subnet definitions without adjusting zones.

Related errors

• could not find public subnet in zone: %q
• subnet %q had unknown type %q
• subnet %q had unknown type %q
• error instance group cannot span public and private subnets
• cannot find subnet %q (declared in instance group %q, not fo

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/72cdc2b847a9f5c9. Report an issue: GitHub.