kubernetes/kops · error

invalid AWS zone: in subnet

Error message

invalid AWS zone: %q in subnet %q

What it means

AWS availability zone names are region prefix plus a letter (e.g. us-east-1a); FindRegion uses this to derive the region by stripping the final character. If a subnet's zone is 2 characters or fewer it cannot contain a region prefix, so the library rejects it as an invalid AWS zone. This catches misformatted zone values before they produce a bogus region.

Solutions

1. Use the full AWS availability zone name in each subnet's zone field (e.g. us-east-1a, not a)
2. Fix YAML so the zone value is not truncated or split across lines
3. Verify with `kops get cluster -oyaml` that zones render as full zone names

Example fix

// before
zones: ["a", "b"]
// after
zones: ["us-east-1a", "us-east-1b"]

var awsZoneRe = regexp.MustCompile(`^[a-z]{2}(-gov)?-[a-z]+-\d[a-z]$`)
func validZone(z string) bool { return awsZoneRe.MatchString(z) }

When it happens

Trigger: FindRegion encountering a subnet whose Zone field length is <= 2 (e.g. "a", "1a", "eu"), triggering the len(subnet.Zone) <= 2 check.

Common situations: Users writing just the zone suffix ('a' or 'b') instead of the full zone name; YAML quoting mishaps truncating values; copying GCE zone style ('us-east1-a' is fine but 'a' alone is not).

Related errors

• cannot mix egress values in private or IPv6-capable subnets
• error Clusters cannot span multiple regions
• subnet must specify a zone or the ID of an existing subnet
• AWS partition was empty
• building full cluster spec

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/0e67e1bd6490f363. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/awsup/aws_utils.go:105

	return fmt.Errorf("Region is not a recognized EC2 region: %q (check you have specified valid zones?)", region)
}

// FindRegion determines the region from the zones specified in the cluster
func FindRegion(cluster *kops.Cluster) (string, error) {
	region := ""

	for _, subnet := range cluster.Spec.Networking.Subnets {
		if subnet.Zone == "" {
			// The zone of a subnet specified by ID is looked up from the cloud later.
			if subnet.ID == "" {
				return "", fmt.Errorf("subnet %q must specify a zone or the ID of an existing subnet", subnet.Name)
			}
			continue
		}

		if len(subnet.Zone) <= 2 {
			return "", fmt.Errorf("invalid AWS zone: %q in subnet %q", subnet.Zone, subnet.Name)
		}

		zoneRegion := subnet.Zone[:len(subnet.Zone)-1]
		if region != "" && zoneRegion != region {
			return "", fmt.Errorf("error Clusters cannot span multiple regions (found zone %q, but region is %q)", subnet.Zone, region)
		}

		region = zoneRegion
	}

	if region == "" {
		return "", fmt.Errorf("could not determine cluster region: no subnet specifies a zone")
	}

	return region, nil
}

// SupportsS3BootstrapEndpoint reports whether the region uses the amazonaws.com partition DNS

View on GitHub (pinned to 4c8573c808)