kubernetes/kops · error

unknown subnet type %q for InstanceGroup %q

Error message

unknown subnet type %q for InstanceGroup %q

What it means

karpenterAssociatePublicIP inspects subnets[0].Type and maps subnet types to a public-IP boolean (public/utility => true unless overridden; dualstack/private => false). Any SubnetType outside these known values is not understood and produces this error. It guards against new or corrupted subnet type values reaching the Karpenter template path.

Source

Thrown at upup/pkg/fi/cloudup/template_functions_karpenter.go:503

func (tf *TemplateFunctions) karpenterAssociatePublicIP(ig *kops.InstanceGroup) (*bool, error) {
	subnets, err := tf.GatherSubnets(ig)
	if err != nil {
		return nil, err
	}
	if len(subnets) == 0 {
		return nil, fmt.Errorf("could not determine any subnets for InstanceGroup %q; subnets was %s", ig.Name, ig.Spec.Subnets)
	}

	switch subnets[0].Type {
	case kops.SubnetTypePublic, kops.SubnetTypeUtility:
		if ig.Spec.AssociatePublicIP != nil {
			return ig.Spec.AssociatePublicIP, nil
		}
		return new(true), nil
	case kops.SubnetTypeDualStack, kops.SubnetTypePrivate:
		return new(false), nil
	default:
		return nil, fmt.Errorf("unknown subnet type %q for InstanceGroup %q", subnets[0].Type, ig.Name)
	}
}

func (tf *TemplateFunctions) karpenterRequirements(ig *kops.InstanceGroup) []karpenterRequirement {
	requirements := []karpenterRequirement{
		{
			Key:      karpenterOSLabel,
			Operator: "In",
			Values:   []string{"linux"},
		},
	}

	var instanceRequirements *kops.InstanceRequirementsSpec
	if ig.Spec.MixedInstancesPolicy != nil {
		instanceRequirements = ig.Spec.MixedInstancesPolicy.InstanceRequirements
	}

	if instanceTypes := karpenterInstanceTypes(ig); len(instanceTypes) != 0 {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set the subnet type in the cluster spec to one of: Public, Utility, DualStack, Private.
2. Fix typos/case in spec.subnets[].type values.
3. Upgrade (or downgrade to matching) kOps so the binary supports the subnet type in your spec.
4. Run `kops replace -f cluster.yaml` after correcting the spec, then `kops update cluster`.

Example fix

// before
subnets:
- name: us-east-1a
  type: publi
// after
subnets:
- name: us-east-1a
  type: Public

valid := map[kops.SubnetType]bool{
    kops.SubnetTypePublic: true,
    kops.SubnetTypeUtility: true,
    kops.SubnetTypeDualStack: true,
    kops.SubnetTypePrivate: true,
}
for _, s := range cluster.Spec.Subnets {
    if !valid[s.Type] {
        return fmt.Errorf("subnet %q has unsupported type %q", s.Name, s.Type)
    }
}

func knownSubnetType(t kops.SubnetType) bool {
    switch t {
    case kops.SubnetTypePublic, kops.SubnetTypeUtility,
         kops.SubnetTypeDualStack, kops.SubnetTypePrivate:
        return true
    }
    return false
}

When it happens

Trigger: An InstanceGroup used by Karpenter EC2NodeClass rendering has a first subnet whose Type is a value not in {Public, Utility, DualStack, Private} — e.g. an unknown string or a newly introduced SubnetType the current kOps build doesn't know.

Common situations: Hand-edited cluster YAML with a misspelled subnet type (e.g. `public` lowercase); running an older kOps binary against a newer cluster spec that uses a new SubnetType enum value.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid InstanceGroup name: %v
• spec.PublicKey is required
• adding keypair to %q is not supported
• unable to parse YAML %v: %v
• error adding SSH public key: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5cc9a8b6bab9a8ea. Report an issue: GitHub.