kubernetes/kops · error

invalid AWS zone: %q in subnet %q

Error message

invalid AWS zone: %q in subnet %q

What it means

AWS availability zone names are region prefix plus a letter (e.g. us-east-1a); FindRegion uses this to derive the region by stripping the final character. If a subnet's zone is 2 characters or fewer it cannot contain a region prefix, so the library rejects it as an invalid AWS zone. This catches misformatted zone values before they produce a bogus region.

Source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:105

	return fmt.Errorf("Region is not a recognized EC2 region: %q (check you have specified valid zones?)", region)
}

// FindRegion determines the region from the zones specified in the cluster
func FindRegion(cluster *kops.Cluster) (string, error) {
	region := ""

	for _, subnet := range cluster.Spec.Networking.Subnets {
		if subnet.Zone == "" {
			// The zone of a subnet specified by ID is looked up from the cloud later.
			if subnet.ID == "" {
				return "", fmt.Errorf("subnet %q must specify a zone or the ID of an existing subnet", subnet.Name)
			}
			continue
		}

		if len(subnet.Zone) <= 2 {
			return "", fmt.Errorf("invalid AWS zone: %q in subnet %q", subnet.Zone, subnet.Name)
		}

		zoneRegion := subnet.Zone[:len(subnet.Zone)-1]
		if region != "" && zoneRegion != region {
			return "", fmt.Errorf("error Clusters cannot span multiple regions (found zone %q, but region is %q)", subnet.Zone, region)
		}

		region = zoneRegion
	}

	if region == "" {
		return "", fmt.Errorf("could not determine cluster region: no subnet specifies a zone")
	}

	return region, nil
}

// SupportsS3BootstrapEndpoint reports whether the region uses the amazonaws.com partition DNS

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use the full AWS availability zone name in each subnet's zone field (e.g. us-east-1a, not a)
2. Fix YAML so the zone value is not truncated or split across lines
3. Verify with `kops get cluster -oyaml` that zones render as full zone names

Example fix

// before
zones: ["a", "b"]
// after
zones: ["us-east-1a", "us-east-1b"]

var awsZoneRe = regexp.MustCompile(`^[a-z]{2}(-gov)?-[a-z]+-\d[a-z]$`)
func validZone(z string) bool { return awsZoneRe.MatchString(z) }

When it happens

Trigger: FindRegion encountering a subnet whose Zone field length is <= 2 (e.g. "a", "1a", "eu"), triggering the len(subnet.Zone) <= 2 check.

Common situations: Users writing just the zone suffix ('a' or 'b') instead of the full zone name; YAML quoting mishaps truncating values; copying GCE zone style ('us-east1-a' is fine but 'a' alone is not).

Related errors

• cannot mix egress values in private or IPv6-capable subnets
• subnet %q must specify a zone or the ID of an existing subne
• error Clusters cannot span multiple regions (found zone %q,
• validation of the full cluster and instance group specs fail
• --region is required (when --external)

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0e67e1bd6490f363. Report an issue: GitHub.