kubernetes/kops · error

invalid networking option %s. Kubenet does not support priva

Error message

invalid networking option %s. Kubenet does not support private topology

What it means

With private topology, nodes live in private subnets and kops' kubenet networking plugin cannot operate in that layout (it requires public subnets/route handling it does not manage). setupTopology therefore rejects the combination of --topology private with --networking kubenet.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:1401

	err := setupDNSTopology(opt, cluster)
	if err != nil {
		return nil, err
	}

	switch opt.Topology {
	case api.TopologyPublic:

		if opt.Bastion {
			return nil, fmt.Errorf("bastion supports --topology='private' only")
		}

		for i := range cluster.Spec.Networking.Subnets {
			cluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePublic
		}

	case api.TopologyPrivate:
		if cluster.Spec.Networking.Kubenet != nil {
			return nil, fmt.Errorf("invalid networking option %s. Kubenet does not support private topology", opt.Networking)
		}

		for i := range cluster.Spec.Networking.Subnets {
			cluster.Spec.Networking.Subnets[i].Type = api.SubnetTypePrivate
		}

		var zoneToSubnetProviderID map[string]string
		var err error
		if len(opt.Zones) > 0 && len(opt.UtilitySubnetIDs) > 0 {
			switch cluster.GetCloudProvider() {
			case api.CloudProviderAWS:
				zoneToSubnetProviderID, err = getAWSZoneToSubnetProviderID(cluster.Spec.Networking.NetworkID, opt.Zones[0][:len(opt.Zones[0])-1], opt.UtilitySubnetIDs)
				if err != nil {
					return nil, err
				}
			case api.CloudProviderOpenstack:
				zoneToSubnetProviderID, err = getOpenstackZoneToSubnetProviderID(cluster, allZones.List(), opt.UtilitySubnetIDs)
				if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Switch networking to a private-topology-compatible plugin, e.g. --networking calico, cilium, or canal.
2. Keep --networking kubenet but use --topology public (if acceptable).
3. Update cluster templates to a modern CNI before switching to private topology.

Example fix

// before
kops create cluster my.cluster --topology private --networking kubenet
// after
kops create cluster my.cluster --topology private --networking calico

if [ "$TOPOLOGY" = "private" ] && [ "$NETWORKING" = "kubenet" ]; then echo "kubenet unsupported with private topology"; exit 1; fi

if err := createCluster(); err != nil && strings.Contains(err.Error(), "Kubenet does not support private topology") { /* switch to calico/cilium/canal and retry */ }

When it happens

Trigger: `kops create cluster --topology private --networking kubenet` — the Kubenet spec is non-nil and topology is api.TopologyPrivate, so setupTopology returns this error.

Common situations: Using legacy templates that defaulted to kubenet while upgrading to private topology; following old tutorials recommending kubenet; mixing flags from different guides.

Related errors

• error instance group cannot span public and private subnets
• building json: %w
• multiple physical network interfaces found with MAC address
• cannot determine challenge endpoint for instance id: %s
• could not find public subnet in zone: %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3e65a67c0d0e7ac7. Report an issue: GitHub.