VPC with id %q was set to be shared, but did not have Enable

Error message

VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.

What it means

For a shared VPC, kOps requires EnableDNSSupport=true because cluster DNS and internal name resolution depend on it. If changes show EnableDNSSupport needs to be enabled but the VPCSkipEnableDNSSupport feature flag is off, RenderAWS refuses to proceed with this error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:191

func (e *VPC) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (_ *VPC) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *VPC) error {
	ctx := context.TODO()
	shared := fi.ValueOf(e.Shared)
	if shared {
		// Verify the VPC was found and matches our required settings
		if a == nil {
			return fmt.Errorf("VPC with id %q not found", fi.ValueOf(e.ID))
		}

		if changes != nil && changes.EnableDNSSupport != nil {
			if featureflag.VPCSkipEnableDNSSupport.Enabled() {
				klog.Warningf("VPC did not have EnableDNSSupport=true, but ignoring because of VPCSkipEnableDNSSupport feature-flag")
			} else {
				// TODO: We could easily just allow kops to fix this...
				return fmt.Errorf("VPC with id %q was set to be shared, but did not have EnableDNSSupport=true.", fi.ValueOf(e.ID))
			}
		}
	}

	if a == nil {
		klog.V(2).Infof("Creating VPC with CIDR: %q", *e.CIDR)

		request := &ec2.CreateVpcInput{
			CidrBlock:         e.CIDR,
			TagSpecifications: awsup.EC2TagSpecification(ec2types.ResourceTypeVpc, e.Tags),
		}

		response, err := t.Cloud.EC2().CreateVpc(ctx, request)
		if err != nil {
			return fmt.Errorf("error creating VPC: %v", err)
		}

		e.ID = response.Vpc.VpcId

View on GitHub (pinned to 4c8573c808)

Solutions

Enable DNS support on the VPC: `aws ec2 modify-vpc-attribute --vpc-id <id> --enable-dns-support`
Or set the feature flag to skip: `export KOPS_FEATURE_FLAGS=VPCSkipEnableDNSSupport` (not recommended; DNS will break)
Or run `kops edit cluster` and point to a VPC with DNS support enabled

Example fix

// before
aws ec2 describe-vpc-attribute --vpc-id vpc-x --attribute enableDnsSupport  # false
// after
aws ec2 modify-vpc-attribute --vpc-id vpc-x --enable-dns-support '{"Value":true}'

Defensive patterns

Strategy: validation

Validate before calling

out, _ := ec2Client.DescribeVpcAttribute(ctx, &ec2.DescribeVpcAttributeInput{VpcId: vpcID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport})
if out != nil && !fi.ValueOf(out.EnableDnsSupport) {
	return fmt.Errorf("shared VPC %s must have EnableDNSSupport=true before apply", vpcID)
}

Try / catch

err := kopsUpdateCluster()
if err != nil && strings.Contains(err.Error(), "EnableDNSSupport=true") {
	// remediate: enable DNS support on the VPC, then retry
}

Prevention

Enable DNS support+hostnames on any VPC before sharing it with kOps
Check VPC attributes during VPC onboarding review
Only use VPCSkipEnableDNSSupport with a full understanding DNS will break
Document VPC prerequisites for teams sharing network accounts

When it happens

Trigger: Shared VPC has EnableDNSSupport=false and the apply computes a change to enable it; feature flag VPCSkipEnableDNSSupport not enabled, so the preflight check fails.

Common situations: Reusing a corporate VPC where DNS hostnames/support were never enabled; org policy disabling VPC DNS settings; upgrading an older cluster spec onto a newly shared VPC.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ffe27daacbcb89e6. Report an issue: GitHub.