kubernetes/kops · error

subnet %q had unknown type %q

Error message

subnet %q had unknown type %q

What it means

When kOps auto-selects subnets for the API load balancer, it classifies each cluster subnet type (Public, Utility, DualStack, Private) to decide eligibility. This error fires when a subnet in spec.networking.subnets has a type outside the known enum, so the builder cannot determine whether it can back the load balancer.

Source

Thrown at pkg/model/awsmodel/api_loadbalancer.go:102

	} else {
		// Compute the subnets - only one per zone, and then break ties based on chooseBestSubnetForELB
		subnetsByZone := make(map[string][]*kops.ClusterSubnetSpec)
		for i := range b.Cluster.Spec.Networking.Subnets {
			subnet := &b.Cluster.Spec.Networking.Subnets[i]

			switch subnet.Type {
			case kops.SubnetTypePublic, kops.SubnetTypeUtility:
				if lbSpec.Type != kops.LoadBalancerTypePublic {
					continue
				}

			case kops.SubnetTypeDualStack, kops.SubnetTypePrivate:
				if lbSpec.Type != kops.LoadBalancerTypeInternal {
					continue
				}

			default:
				return fmt.Errorf("subnet %q had unknown type %q", subnet.Name, subnet.Type)
			}

			subnetsByZone[subnet.Zone] = append(subnetsByZone[subnet.Zone], subnet)
		}

		for zone, subnets := range subnetsByZone {
			subnet := b.chooseBestSubnetForELB(zone, subnets)

			nlbSubnetMappings = append(nlbSubnetMappings, &awstasks.SubnetMapping{Subnet: b.LinkToSubnet(subnet)})
		}
	}

	var nlb *awstasks.NetworkLoadBalancer
	{
		var nlbListeners []*awstasks.NetworkLoadBalancerListener

		if lbSpec.SSLCertificate == "" {
			listener443 := &awstasks.NetworkLoadBalancerListener{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set each subnet type to a valid value: Public, Utility, Private, or DualStack
2. Run `kops get cluster -o yaml`, fix subnet types, and `kops replace -f` the spec
3. Alternatively set api.loadBalancer.subnets explicitly so auto-selection (and its type check) is bypassed

Example fix

# before
subnets:
- name: us-east-1a
  type: privte
  zone: us-east-1a
# after
subnets:
- name: us-east-1a
  type: Private
  zone: us-east-1a

valid := map[kops.SubnetType]bool{
    kops.SubnetTypePublic: true,
    kops.SubnetTypeUtility: true,
    kops.SubnetTypePrivate: true,
    kops.SubnetTypeDualStack: true,
}
for _, s := range cluster.Spec.Networking.Subnets {
    if !valid[s.Type] {
        return fmt.Errorf("subnet %q has invalid type %q", s.Name, s.Type)
    }
}

func knownSubnetType(t kops.SubnetType) bool {
    switch t {
    case kops.SubnetTypePublic, kops.SubnetTypeUtility,
        kops.SubnetTypePrivate, kops.SubnetTypeDualStack:
        return true
    }
    return false
}

if err := kopsUpdateCluster(cluster); err != nil {
    if strings.Contains(err.Error(), "had unknown type") {
        // correct spec.networking.subnets[].type and retry
    }
    return err
}

When it happens

Trigger: Running kops update/create cluster on AWS with api.loadBalancer configured and no explicit api.loadBalancer.subnets, where a subnet's spec.networking.subnets[].type is an unrecognized string (typo like "privte", "Public " or a removed/renamed type value).

Common situations: Hand-edited cluster specs, migration from older kOps versions where subnet type values changed, or copy-pasted specs from non-AWS examples with different subnet type naming.

Related errors

• unhandled LoadBalancer type %q
• subnet %q had unknown type %q
• could not find public subnet in zone: %q
• found multiple public subnets in zone: %q
• subnet %q must specify a zone or the ID of an existing subne

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2d940160a0c137d1. Report an issue: GitHub.