kubernetes/kops · error

VPC with id %q not found

Error message

VPC with id %q not found

What it means

In RenderAWS, when the VPC task is marked shared, kOps will not create the VPC; it only validates an existing one. If the actual (a) state is nil — no VPC matched the given ID/tags — it returns this error instead of creating anything.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:183

		if changes.CIDR != nil {
			// TODO: Do we want to destroy & recreate the VPC?
			return fi.FieldIsImmutable(e.CIDR, a.CIDR, field.NewPath("CIDR"))
		}
	}
	return nil
}

func (e *VPC) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (_ *VPC) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPC) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {
		// Verify the VPC was found and matches our required settings
		if a == nil {
			return fmt.Errorf("VPC with id %q not found", fi.ValueOf(e.ID))
		}

		if changes != nil && changes.EnableDNSSupport != nil {
			if featureflag.VPCSkipEnableDNSSupport.Enabled() {
				klog.Warningf("VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag")
			} else {
				// TODO: We could easily just allow kops to fix this...
				return fmt.Errorf("VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.", fi.ValueOf(e.ID))
			}
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating VPC with CIDR: %q", *e.CIDR)

		request := &ec2.CreateVpcInput{
			CidrBlock:         e.CIDR,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),

View on GitHub (pinned to 4c8573c808)

Solutions

1. Correct the VPC ID in the cluster spec (`kops edit cluster`) or remove shared:true to let kOps create the VPC
2. Verify the VPC exists: `aws ec2 describe-vpcs --vpc-ids <id>` in the target region/account
3. Re-run `kops update cluster` after fixing

Example fix

// before (shared, missing VPC)
sharedVPC: vpc-0deadbeef
// after: correct existing ID or unshare
sharedVPC: vpc-0123456789abcdef0
// or remove shared:true so kOps creates the VPC

vpcID := "vpc-0123456789abcdef0"
out, err := ec2Client.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{VpcIds: []string{vpcID}})
if err != nil || len(out.Vpcs) == 0 {
	return fmt.Errorf("VPC %s does not exist in region/account; fix cluster spec or unshare", vpcID)
}

func sharedVPCResolvable(e *awstasks.VPC, a *awstasks.VPC) bool {
	return !fi.ValueOf(e.Shared) || a != nil
}

err := target.RenderAWS(task)
if err != nil && strings.Contains(err.Error(), "not found") {
	// prompt: verify VPC ID in spec or set shared:false to create
}

When it happens

Trigger: Task spec has shared=true but the referenced VPC ID does not exist (typo in cluster spec), was deleted, or is in a different region/account so lookup found nothing.

Common situations: Hand-edited cluster spec pointing at a removed VPC; cross-account/region mismatch; VPC deleted out-of-band after cluster spec was generated.

Related errors

• VPC with id %q was set to be shared, but did not have Enable
• IPv6 CIDR block provided by Amazon not found
• failed to load default aws config for IMDS client: %w
• failed to load default aws config for STS client: %w
• loading AWS config: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/dd2a1cd5f60aeb81. Report an issue: GitHub.