kubernetes/kops · error

Subnet not set

Error message

Subnet not set

What it means

RenderAWS requires e.Subnet to be set before tagging the subnet with the AssociatedNatgateway tag. A nil Subnet means the NatGateway task was constructed without its subnet link, indicating a spec/task-building bug, so it fails fast.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:336

		request.SubnetId = e.Subnet.ID
		response, err := t.Cloud.EC2().CreateNatGateway(ctx, request)
		if err != nil {
			return fmt.Errorf("Error creating Nat Gateway: %v", err)
		}
		e.ID = response.NatGateway.NatGatewayId
		id = e.ID
	} else {
		id = a.ID
	}

	err := t.AddAWSTags(*e.ID, e.Tags)
	if err != nil {
		return fmt.Errorf("unable to tag NatGateway")
	}

	// Tag the associated subnet
	if e.Subnet == nil {
		return fmt.Errorf("Subnet not set")
	} else if e.Subnet.ID == nil {
		return fmt.Errorf("Subnet ID not set")
	}

	// TODO: AssociatedNatgateway tag is obsolete - we can get from the route table instead
	tags := make(map[string]string)
	tags["AssociatedNatgateway"] = *id
	err = t.AddAWSTags(*e.Subnet.ID, tags)
	if err != nil {
		return fmt.Errorf("unable to tag subnet %v", err)
	}

	// If this is a shared NGW, we need to tag it
	// The tag that implies "shared" is `AssociatedNatgateway`=> NGW-ID
	// This is better than just a tag that's shared because this lets us create a whitelist of these NGWs
	// without doing a bunch more work in `kutil/delete_cluster.go`

	if fi.ValueOf(e.Shared) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check `kops get cluster -o yaml` and ensure each private subnet definition is intact and named consistently
2. Re-generate the spec rather than hand-editing, then `kops update cluster --yes`
3. If you hit this from custom code, always assign e.Subnet = &SubnetTask{...} link before RenderAWS
4. Upgrade kops to the latest patch release in case it's a known task-wiring bug

Example fix

// before: subnet reference dropped
// cluster spec private subnet removed but NatGateway task remains
// after: restore the subnet definition
subnets:
- name: private-a
  type: Private
  zone: us-east-1a

// before apply, ensure every private subnet resolves
for _, s := range cluster.Spec.Subnets {
  if s.Type == "Private" && s.Name == "" { return fmt.Errorf("private subnet entry missing name") }
}

func subnetLinked(e *NatGateway) bool { return e.Subnet != nil }

err := applyCluster(ctx)
if err != nil && strings.Contains(err.Error(), "Subnet not set") {
  // inspect task wiring: restore the missing subnet definition in the cluster spec
}

When it happens

Trigger: e.Subnet == nil in RenderAWS — the NatGateway task's Subnet link was never populated during taskmap/build of the cluster spec (e.g. subnet task missing or misnamed in the spec so the link resolves to nil).

Common situations: Hand-edited cluster specs referencing a subnet name that doesn't exist; kops internal wiring issues after version upgrades; custom code constructing NatGateway tasks without Subnet.

Related errors

• NAT gateway %q not found
• DeviceName not set for volume
• error populating configuration: %v
• error initializing AWS client: %v
• error populating configuration: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4aa2d0707080583f. Report an issue: GitHub.