What causes "kOps IPAM controller not supported on cloud %q" in kubernetes/kops?

Only enable the kOps IPAM controller on supported clouds (AWS, GCE, metal); use the cloud's native IPAM/CNI features instead on other providers.

kubernetes/kops · error

kOps IPAM controller not supported on cloud %q

Error message

kOps IPAM controller not supported on cloud %q

What it means

The kOps IPAM controller (prefix building) only supports clouds where nodeup can manage node IP prefixes: AWS, GCE, and bare metal. Build() is called during nodeup model construction, and if the cluster's CloudProvider is any other value (e.g. OpenStack, Azure, DigitalOcean, Hetzner), it returns this error because kOps IPAM has no implementation for that cloud.

Source

Thrown at nodeup/pkg/model/prefix.go:47

}

var _ fi.NodeupModelBuilder = &PrefixBuilder{}

func (b *PrefixBuilder) Build(c *fi.NodeupModelBuilderContext) error {
	if !b.IsKopsControllerIPAM() {
		return nil
	}
	switch b.CloudProvider() {
	case kops.CloudProviderAWS:
		c.AddTask(&nodetasks.Prefix{
			Name: "prefix",
		})
	case kops.CloudProviderGCE:
		// Prefix is assigned by GCE
	case kops.CloudProviderMetal:
		// IPv6 must be configured externally (not by nodeup)
	default:
		return fmt.Errorf("kOps IPAM controller not supported on cloud %q", b.CloudProvider())
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

Only enable the kOps IPAM controller on supported clouds (AWS, GCE, metal); use the cloud's native IPAM/CNI features instead on other providers.
Update the cluster spec: remove/disable prefix delegation (kOps IPAM) for the unsupported cloud, e.g. set the networking config appropriately, then run `kops update cluster` and re-bootstrap.
If the cloud is genuinely AWS/GCE/metal, verify nodeup is receiving the correct CloudProvider value (check NodeupConfig / cluster spec cloudProvider field).

Example fix

// before: kops IPAM enabled on unsupported cloud (e.g. openstack)
spec:
  cloudProvider: openstack
  networking:
    ipv6: true
// after: disable prefix/IPAM or move to a supported cloud
spec:
  cloudProvider: openstack
  networking:
    ipv6: false  # use cloud-native IPAM instead

Defensive patterns

Strategy: validation

Validate before calling

supported := map[string]bool{"aws": true, "gce": true, "metal": true}
if !supported[cluster.Spec.CloudProvider] {
	// do not enable kOps IPAM / prefix delegation on this cloud
	cluster.Spec.Networking.IPv6 = false
}

Type guard

func kopsIPAMSupported(provider string) bool {
	switch provider {
	case "aws", "gce", "metal":
		return true
	}
	return false
}

Try / catch

if err := prefixBuilder.Build(ctx); err != nil {
	if strings.Contains(err.Error(), "IPAM controller not supported on cloud") {
		klog.Warningf("kOps IPAM unavailable: %v — falling back to cloud-native IPAM", err)
		return nil // skip prefix model
	}
	return err
}

Prevention

Enable kOps IPAM/prefix delegation only on AWS, GCE, or bare-metal clusters
Validate cluster specs in CI against a list of IPAM-supported cloud providers
Do not copy IPv6/prefix networking blocks from AWS/GCE example specs onto other clouds
Keep cloudProvider in the cluster spec consistent with the kOps version in use

When it happens

Trigger: Running nodeup against a cluster whose spec has kOps IPAM enabled (IPv6 prefix delegation) on an unsupported cloud provider — the switch in nodeup/pkg/model/prefix.go:Build falls to the default case because b.CloudProvider() is not AWSspot/GCE/Metal.

Common situations: Deploying an IPv6/prefix-delegation cluster spec copied from an AWS or GCE example onto OpenStack, Azure, Hetzner, etc.; upgrading kOps with a config where cloudProvider changed; typos or drift between the cluster spec's cloudProvider and what nodeup was built for.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/43eafb8a6d702167. Report an issue: GitHub.