kubernetes/kops · error

validation of the full cluster and instance group specs fail

Error message

validation of the full cluster and instance group specs failed: %w

What it means

After expanding instance groups into full specs, RunCreateCluster calls validation.DeepValidate on the fully built cluster and instance groups. This error means the combined spec is invalid (bad subnet mapping, invalid machine type, missing required fields, cross-object conflicts). It fires only when the full-spec build succeeded but deep validation rejected it, and it wraps the detailed validation message.

Source

Thrown at cmd/kops/create_cluster.go:775

			return fmt.Errorf("error loading cluster addon %s: %v", p, err)
		}
		addons = append(addons, addon.Objects...)
	}

	{
		// Build full IG spec to ensure we end up with a valid IG
		fullInstanceGroups := []*api.InstanceGroup{}
		for _, group := range instanceGroups {
			fullGroup, err := cloudup.PopulateInstanceGroupSpec(cluster, group, cloud, clusterResult.Channel)
			if err != nil {
				return err
			}
			fullInstanceGroups = append(fullInstanceGroups, fullGroup)
		}

		err = validation.DeepValidate(fullCluster, fullInstanceGroups, true, clientset.VFSContext(), nil)
		if err != nil {
			return fmt.Errorf("validation of the full cluster and instance group specs failed: %w", err)
		}
	}

	if c.DryRun {
		var obj []runtime.Object
		obj = append(obj, cluster)

		for _, group := range instanceGroups {
			// Cluster name is not populated, and we need it
			group.ObjectMeta.Labels = make(map[string]string)
			group.ObjectMeta.Labels[api.LabelClusterName] = cluster.ObjectMeta.Name
			obj = append(obj, group)
		}

		for name, key := range c.SSHPublicKeys {
			obj = append(obj, &api.SSHCredential{
				ObjectMeta: metav1.ObjectMeta{
					Name: name,

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %w message for the specific field that failed validation.
2. Fix the offending flag, zone/subnet, or cluster name and re-run.
3. Use `kops create -f cluster.yaml --dry-run` to validate a manifest interactively.
4. Check docs for the cloud provider's supported values (zones, machine types, networking modes).

Example fix

// before
kops create cluster --zones us-east-1a --node-size t3.micro k8s.local
// after
kops create cluster --zones us-east-1a --node-size t3.micro example-cluster.k8s.local

// sanity-check before running create
for _, ig := range instanceGroups {
	if ig.Spec.MachineType == "" || len(ig.Spec.Subnets) == 0 {
		return fmt.Errorf("instance group %s missing machineType or subnets", ig.ObjectMeta.Name)
	}
}
if !strings.Contains(clusterName, ".") && cloudProvider != "" {
	// gossip-only names (no dots) are invalid for many cloud providers
}

if err := runCreateCluster(...); err != nil {
	var verr *validation.ValidationError
	if strings.Contains(err.Error(), "validation of the full cluster") {
		// err wraps the detailed field errors; log and fix the flagged fields
	}
	return err
}

When it happens

Trigger: `kops create cluster` with flags/specs that pass basic parsing but fail DeepValidate: invalid --networking choice, instance group referencing a nonexistent zone/subnet, invalid Kubernetes version, cluster name not matching cloud DNS requirements.

Common situations: Using an instance group zone outside the cluster's region; typos in cloud-specific flags (bad GCE machine type); mixing networking options unsupported by the topology; cluster name without a valid DNS suffix for the cloud.

Related errors

• at least one channel URL is required
• spec.PublicKey is required
• unable to execute --dry-run without setting --output
• --name is required
• --azure-subscription-id is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/18f899bc04452ca4. Report an issue: GitHub.