kubernetes/kops · error

subnet %q had unknown type %q

Error message

subnet %q had unknown type %q

What it means

While assigning the bastion load balancer to subnets, the builder iterates cluster subnets and only understands types Public, Private, DualStack and Utility. A subnet whose spec.networking.subnets[].type is anything else aborts the build with this error. It is a per-subnet enum validation guard.

Source

Thrown at pkg/model/awsmodel/bastion.go:215

	{
		// Compute the subnets - only one per zone, and then break ties based on chooseBestSubnetForNLB
		subnetsByZone := make(map[string][]*kops.ClusterSubnetSpec)
		for i := range b.Cluster.Spec.Networking.Subnets {
			subnet := &b.Cluster.Spec.Networking.Subnets[i]

			switch subnet.Type {
			case kops.SubnetTypePublic, kops.SubnetTypeUtility:
				if bastionLoadBalancerType != kops.LoadBalancerTypePublic {
					continue
				}

			case kops.SubnetTypeDualStack, kops.SubnetTypePrivate:
				if bastionLoadBalancerType != kops.LoadBalancerTypeInternal {
					continue
				}

			default:
				return fmt.Errorf("subnet %q had unknown type %q", subnet.Name, subnet.Type)
			}

			subnetsByZone[subnet.Zone] = append(subnetsByZone[subnet.Zone], subnet)
		}

		for zone, subnets := range subnetsByZone {
			for _, subnet := range subnets {
				sshAllowedCIDRs = append(sshAllowedCIDRs, subnet.CIDR)
			}
			subnet := b.chooseBestSubnetForNLB(zone, subnets)
			nlbSubnetMappings = append(nlbSubnetMappings, &awstasks.SubnetMapping{Subnet: b.LinkToSubnet(subnet)})
		}
	}

	sshAllowedCIDRs = append(sshAllowedCIDRs, b.Cluster.Spec.SSHAccess...)
	for _, cidr := range sshAllowedCIDRs {
		// Allow incoming SSH traffic to the NLB
		// TODO: Could we get away without an NLB here?  Tricky to fix if dns-controller breaks though...

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set every spec.networking.subnets[].type to one of: public, private, dualstack, utility
2. Remove or fix the offending subnet entry reported by name in the error message
3. If the subnet is only for utilities, explicitly set type: utility

Example fix

// before (cluster.yaml)
subnets:
- name: aws-main
  type: pubic
  zone: us-east-1a
// after
subnets:
- name: aws-main
  type: public
  zone: us-east-1a

valid := map[kops.SubnetType]bool{kops.SubnetTypePublic: true, kops.SubnetTypePrivate: true, kops.SubnetTypeUtility: true, kops.SubnetTypeDualStack: true}
for _, s := range cluster.Spec.Networking.Subnets {
    if !valid[s.Type] {
        return fmt.Errorf("subnet %q has invalid type %q", s.Name, s.Type)
    }
}

func knownSubnetType(t kops.SubnetType) bool {
    switch t {
    case kops.SubnetTypePublic, kops.SubnetTypePrivate, kops.SubnetTypeUtility, kops.SubnetTypeDualStack:
        return true
    }
    return false
}

if err := buildModel(ctx); err != nil {
    if strings.Contains(err.Error(), "had unknown type") {
        return fmt.Errorf("fix spec.networking.subnets[].type (public|private|utility|dualstack): %w", err)
    }
    return err
}

When it happens

Trigger: `kops update cluster` with a bastion configured where any cluster subnet has type set to an unrecognized value (typo like "pubic", "internal", or empty), so it falls through the switch's default branch.

Common situations: Hand-edited cluster specs, copy-pasted subnet blocks from other providers/docs, migration from very old kops versions whose subnet type vocabulary changed, or templating that interpolates an unset variable into the type field.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• subnet %q had unknown type %q
• unhandled bastion LoadBalancer type %q
• could not find public subnet in zone: %q
• found multiple public subnets in zone: %q
• Subnet %q has configured CIDR %q, but the actual CIDR found

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e9dc75de0e34e4a0. Report an issue: GitHub.