What causes "subnet %s and %s have the same zone" in kubernetes/kops?

Pick one subnet per availability zone: --zones us-east-1a,us-east-1b with one subnet in each.

subnet %s and %s have the same zone

Error message

subnet %s and %s have the same zone

What it means

kOps maps each provided subnet to its availability zone (subnet.Zone) and requires a 1:1 zone-to-subnet mapping — two subnets in the same AZ cannot both back the cluster's zone subnets. When a second subnet resolves to an AZ already claimed by an earlier subnet, "subnet %s and %s have the same zone" is returned.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:928

	}
	vpcInfo, err := awsCloud.FindVPCInfo(VPCID)
	if err != nil {
		return res, fmt.Errorf("error describing VPC: %v", err)
	}
	if vpcInfo == nil {
		return res, fmt.Errorf("VPC %q not found", VPCID)
	}
	subnetByID := make(map[string]*fi.SubnetInfo)
	for _, subnetInfo := range vpcInfo.Subnets {
		subnetByID[subnetInfo.ID] = subnetInfo
	}
	for _, subnetID := range subnetIDs {
		subnet, ok := subnetByID[subnetID]
		if !ok {
			return res, fmt.Errorf("subnet %s not found in VPC %s", subnetID, VPCID)
		}
		if res[subnet.Zone] != "" {
			return res, fmt.Errorf("subnet %s and %s have the same zone", subnetID, res[subnet.Zone])
		}
		res[subnet.Zone] = subnetID
	}
	return res, nil
}

func getOpenstackZoneToSubnetProviderID(cluster *api.Cluster, zones []string, subnetIDs []string) (map[string]string, error) {
	res := make(map[string]string)
	osCloud, err := openstack.NewOpenstackCloud(cluster, "new-cluster-zone-to-subnet")
	if err != nil {
		return res, fmt.Errorf("error loading cloud: %v", err)
	}
	osCloud.UseZones(zones)

	networkInfo, err := osCloud.FindVPCInfo(cluster.Spec.Networking.NetworkID)
	if err != nil {
		return res, fmt.Errorf("error describing Network: %v", err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Pick one subnet per availability zone: --zones us-east-1a,us-east-1b with one subnet in each.
Verify each subnet's AZ via `aws ec2 describe-subnets --subnet-ids ...` and deduplicate.
If you need extra CIDRs in the same AZ, use kOps' utility subnets / multiple NetworkCIDR handling instead of duplicating zone subnets.

Example fix

// before
--zones us-east-1a,us-east-1b --subnets subnet-aaa1(1a),subnet-aaa2(1a)
// after
--zones us-east-1a,us-east-1b --subnets subnet-aaa1(1a),subnet-bbb1(1b)

Defensive patterns

Strategy: validation

Validate before calling

out, _ := exec.Command("aws", "ec2", "describe-subnets", "--subnet-ids",
    strings.Join(subnets, " "), "--region", region,
    "--query", "Subnets[].AvailabilityZone", "--output", "json").Output()
if hasDuplicateAZ(out) {
    return fmt.Errorf("duplicate AZ among requested subnets: %s", out)
}

Try / catch

if strings.Contains(err.Error(), "have the same zone") {
    // parse the two subnet IDs from the message, look up their AZs, drop one and retry
}

Prevention

Enforce one subnet per AZ in your subnet-selection script.
Check each subnet's AvailabilityZone via describe-subnets before composing flags.
Keep --zones and --subnets counts aligned, one per zone.

When it happens

Trigger: `kops create cluster --cloud aws --zones us-east-1a,us-east-1b --subnets subnet-1,subnet-2` where both subnet-1 and subnet-2 are in the same AZ (e.g. both us-east-1a), or more subnets than zones are supplied and two land in one AZ.

Common situations: Selecting several subnets from one AZ for extra CIDR space while only listing one zone; mismatched ordering/count between --zones and --subnets; assuming any subnet works with any zone.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/564abcaa508fe9ae. Report an issue: GitHub.