kubernetes/kops · error

Subnet %q not found in VPC %q

Error message

Subnet %q not found in VPC %q

What it means

kOps resolved the configured VPC successfully, but one of the cluster's subnets specified by ID (`subnet.ID`) was not among the VPC's subnets returned by the cloud. The subnet either does not exist, was deleted, or lives in a different VPC/region.

Source

Thrown at upup/pkg/fi/cloudup/subnets.go:86

		vpcInfo, err := cloud.FindVPCInfo(c.Spec.Networking.NetworkID)
		if err != nil {
			return err
		}
		if vpcInfo == nil {
			return fmt.Errorf("VPC %q not found", c.Spec.Networking.NetworkID)
		}

		subnetByID := make(map[string]*fi.SubnetInfo)
		for _, subnetInfo := range vpcInfo.Subnets {
			subnetByID[subnetInfo.ID] = subnetInfo
		}
		for i := range c.Spec.Networking.Subnets {
			subnet := &c.Spec.Networking.Subnets[i]
			if subnet.ID != "" {
				cloudSubnet := subnetByID[subnet.ID]
				if cloudSubnet == nil {
					return fmt.Errorf("Subnet %q not found in VPC %q", subnet.ID, c.Spec.Networking.NetworkID)
				}
				if subnet.CIDR == "" {
					subnet.CIDR = cloudSubnet.CIDR
					// IPv6-only private subnets do not have an IPv4 CIDR
					if subnet.CIDR == "" && (subnet.IPv6CIDR == "" || subnet.Type != kops.SubnetTypePrivate) {
						return fmt.Errorf("Subnet %q did not have CIDR", subnet.ID)
					}
				} else if subnet.CIDR != cloudSubnet.CIDR {
					return fmt.Errorf("Subnet %q has configured CIDR %q, but the actual CIDR found was %q", subnet.ID, subnet.CIDR, cloudSubnet.CIDR)
				}

				if needZones && subnet.Zone == "" {
					subnet.Zone = cloudSubnet.Zone
				} else if subnet.Zone != cloudSubnet.Zone {
					return fmt.Errorf("Subnet %q has configured Zone %q, but the actual Zone found was %q", subnet.ID, subnet.Zone, cloudSubnet.Zone)
				}

			}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify each subnet ID: `aws ec2 describe-subnets --subnet-ids subnet-xxxx` and confirm its VPC matches networkID.
2. Remove or correct the stale subnet entry in the cluster spec, then run `kops update cluster`.
3. If subnets are shared cross-account, ensure the credentials used by kOps can list them.

Example fix

// before
subnets:
- id: subnet-0123456789deadbeef
// after (existing subnet in the VPC)
subnets:
- id: subnet-0abcdef1234567890

out, err := exec.Command("aws", "ec2", "describe-subnets", "--subnet-ids", subnetID,
    "--filters", "Name=vpc-id,Values="+vpcID, "--region", region).Output()
if err != nil || len(out) == 0 {
    return fmt.Errorf("subnet %s not found in VPC %s", subnetID, vpcID)
}

When it happens

Trigger: Cluster spec lists subnets with explicit IDs (e.g. `id: subnet-xxxx`) that are not in `networking.networkID`; the subnet was deleted; wrong region for the API query; credentials cannot describe subnets.

Common situations: Shared-VPC setups where the subnet list was copied from another cluster; subnet deleted by another team's automation; moving a cluster spec between regions without updating subnet IDs.

Related errors

• error listing subnets: %v
• error attaching InternetGateway to VPC: %v
• subnet %s not found in VPC %s
• VPC %q not found
• multiple physical network interfaces found with MAC address

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c60ff3bbe7a71de2. Report an issue: GitHub.