kubernetes/kops · error

must update terraform state for 0.12, and then pass KOPS_TER

Error message

must update terraform state for 0.12, and then pass KOPS_TERRAFORM_0_12_RENAMED=ebs

What it means

Terraform 0.12 disallowed resource names beginning with a digit, so kOps renamed EBS volume TF resources. To prevent Terraform from destroying and recreating volumes (data loss), kOps requires the operator to first migrate TF state and then opt in via the KOPS_TERRAFORM_0_12_RENAMED=ebs environment variable.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/ebsvolume.go:261

	if name[0] >= '0' && name[0] <= '9' {
		usedPrefix = true
		return fmt.Sprintf("ebs-%v", name), usedPrefix
	}
	return name, usedPrefix
}

// PreRun is run before general task execution, and checks for terraform breaking changes.
func (e *EBSVolume) PreRun(c *fi.CloudupContext) error {
	if _, ok := c.Target.(*terraform.TerraformTarget); ok {
		_, usedPrefix := e.TerraformName()
		if usedPrefix {
			if os.Getenv("KOPS_TERRAFORM_0_12_RENAMED") == "" {
				fmt.Fprintf(os.Stderr, "Terraform 0.12 broke compatibility and disallowed names that begin with a number.\n")
				fmt.Fprintf(os.Stderr, "  To move an existing cluster to the new syntax, you must first move existing volumes to the new names.\n")
				fmt.Fprintf(os.Stderr, "  To indicate that you have already performed the rename, pass KOPS_TERRAFORM_0_12_RENAMED=ebs environment variable.\n")
				fmt.Fprintf(os.Stderr, "  Not doing so will result in data loss.\n")
				fmt.Fprintf(os.Stderr, "For detailed instructions: https://github.com/kubernetes/kops/blob/master/permalinks/terraform_renamed.md\n")
				return fmt.Errorf("must update terraform state for 0.12, and then pass KOPS_TERRAFORM_0_12_RENAMED=ebs")
			}
		}
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Migrate each volume resource name in terraform state (terraform state mv) per the permalinks/terraform_renamed.md instructions
2. Export KOPS_TERRAFORM_0_12_RENAMED=ebs once state migration is complete and re-run kOps
3. Verify with `terraform plan` that no volumes are scheduled for replacement before applying

Example fix

// before
kops update cluster mycluster --target=terraform
// after
export KOPS_TERRAFORM_0_12_RENAMED=ebs
kops update cluster mycluster --target=terraform

// Check before generating terraform
if os.Getenv("KOPS_TERRAFORM_0_12_RENAMED") != "ebs" && hasEBSVolumes(cluster) {
    return errors.New("run terraform state mv first, then set KOPS_TERRAFORM_0_12_RENAMED=ebs")
}

When it happens

Trigger: PreRun for terraform targets targeting terraform 0.12+ syntax with EBS volumes in the cluster, when the env var is unset — kOps refuses to render to avoid silent state replacement.

Common situations: Upgrading an existing cluster's terraform output from the legacy digit-prefixed names to the 0.12-compatible names without migrating state first.

Related errors

• DIGITALOCEAN_ACCESS_TOKEN is required
• DIGITALOCEAN_ACCESS_TOKEN is required
• --project cannot be empty; specify a project or omit the fla
• reconcile is not supported with terraform
• error reading project from GCE: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/365d2ab3866023b9. Report an issue: GitHub.