What causes "vpc not yet created.." in kubernetes/kops?

Verify the VPC name and network CIDR in the cluster spec exactly match an existing VPC in the target DO region (`doctl vpc list`).

kubernetes/kops · error

vpc not yet created..

Error message

vpc not yet created..

What it means

GetVPCUUID polls (via vfs.RetryWithBackoff) the list of DigitalOcean VPCs looking for one whose IP range equals the cluster networkCIDR and whose name equals vpcName. Each time no match is found, the retry closure returns this sentinel error so the backoff loop retries; if the VPC never appears, the error surfaces to the caller after retries are exhausted.

Source

Thrown at upup/pkg/fi/cloudup/do/cloud.go:258

	return nil, errors.New("not implemented")
}

func (c *doCloudImplementation) GetVPCUUID(networkCIDR string, vpcName string) (string, error) {
	vpcUUID := ""
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		vpcs, err := c.GetAllVPCs()
		if err != nil {
			return false, err
		}

		for _, vpc := range vpcs {
			if vpc.IPRange == networkCIDR && vpc.Name == vpcName {
				vpcUUID = vpc.ID
				return true, nil
			}
		}

		return false, fmt.Errorf("vpc not yet created..")
	})

	if err != nil {
		return "", err
	}

	if done {
		return vpcUUID, nil
	} else {
		return "", wait.ErrWaitTimeout
	}
}

func (c *doCloudImplementation) GetApiIngressStatus(cluster *kops.Cluster) ([]fi.ApiIngressStatus, error) {
	var ingresses []fi.ApiIngressStatus
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		// Note that this must match Digital Ocean's lb name
		klog.V(2).Infof("Querying DO to find Loadbalancers for API (%q)", cluster.Name)

View on GitHub (pinned to 4c8573c808)

Solutions

Verify the VPC name and network CIDR in the cluster spec exactly match an existing VPC in the target DO region (`doctl vpc list`).
If kOps is supposed to create the VPC, wait for/re-run the create — the retry loop will succeed once the VPC exists.
Check the region configured for the cluster matches the region the VPC was created in.
If the VPC will never match (wrong spec), fix cluster.spec's networkCIDR or the VPC name and re-run.

Example fix

null

Defensive patterns

Strategy: retry

Validate before calling

// verify the VPC exists before calling GetVPCUUID
vpcs, _ := cloud.VPCsService().List(context.TODO(), &godo.ListOptions{})
for _, v := range vpcs {
    if v.Name == vpcName && v.IPRange == networkCIDR { /* ready */ }
}

Try / catch

uuid, err := cloud.GetVPCUUID(cidr, name)
if err != nil {
    if strings.Contains(err.Error(), "vpc not yet created") {
        return createVPCAndWait(cidr, name) // or keep polling
    }
    return err
}

Prevention

Create the VPC before cluster creation, or let kOps create it and don't reference a mismatching one.
Match name and CIDR exactly against the cluster spec networkCIDR.
Confirm the VPC exists in the same DO region as the cluster.
Use `doctl vpc list` to pre-validate name/CIDR pairs.

When it happens

Trigger: GetVPCUUID(networkCIDR, vpcName) is called during cluster creation and no existing VPC matches both the exact CIDR and the exact name — typically because the VPC has not been created yet, or the name/CIDR don't match what DO returned.

Common situations: Cluster creation racing VPC provisioning; a pre-created VPC whose name or CIDR differs from the cluster spec (e.g. default VPC with 10.10.0.0/16 vs cluster CIDR 10.0.0.0/16); region mismatch so the VPC list doesn't include the target VPC.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bc7cc5c0173ad971. Report an issue: GitHub.