exactly one of usePublicIPs and noUsePublicIPs must be true,

Error message

exactly one of usePublicIPs and noUsePublicIPs must be true, please check that only one is true

What it means

The Dataflow runner exposes --use_public_ips and --no_use_public_ips to control worker network addressing. Both being explicitly set is contradictory, so getJobOptions returns this error when both flags were passed on the command line.

Source

Thrown at sdks/go/pkg/beam/runners/dataflow/dataflow.go:329

	}
	if !*update && *transformMapping != "" {
		return nil, errors.New("provided transform_name_mapping without setting the --update flag, so the pipeline would not be updated")
	}
	var updateTransformMapping map[string]string
	if *transformMapping != "" {
		if err := json.Unmarshal([]byte(*transformMapping), &updateTransformMapping); err != nil {
			return nil, errors.Wrapf(err, "error reading --transform_name_mapping flag as JSON")
		}
	}
	if *usePublicIPs == *noUsePublicIPs {
		useSet := isFlagPassed("use_public_ips")
		noUseSet := isFlagPassed("no_use_public_ips")
		// If use_public_ips was explicitly set but no_use_public_ips was not, use that value
		// We take the explicit value of no_use_public_ips if it was set but use_public_ips was not.
		if useSet && !noUseSet {
			*noUsePublicIPs = !*usePublicIPs
		} else if useSet && noUseSet {
			return nil, errors.New("exactly one of usePublicIPs and noUsePublicIPs must be true, please check that only one is true")
		}
	}

	hooks.SerializeHooksToOptions()

	experiments := jobopts.GetExperiments()
	// Ensure that we enable the same set of experiments across all SDKs
	// for Dataflow Portable Runner.
	var fnApiSet, v2set, uwSet, portaSubmission, seSet, wsSet bool
	for _, e := range experiments {
		if strings.Contains(e, "beam_fn_api") {
			fnApiSet = true
		}
		if strings.Contains(e, "use_runner_v2") {
			v2set = true
		}
		if strings.Contains(e, "use_unified_worker") {
			uwSet = true

View on GitHub (pinned to 12126d8942)

Solutions

Remove one of the two flags so only one public-IP preference is set
Audit CI/launch scripts for duplicated conflicting flags (e.g. grep the command line)
Pick the security-preferred default (--no_use_public_ips) when a VPC with Private Google Access is available

Example fix

// before
--use_public_ips --no_use_public_ips
// after
--no_use_public_ips

Defensive patterns

Strategy: validation

Validate before calling

count := 0
for _, f := range os.Args {
    if f == "--use_public_ips" || f == "--no_use_public_ips" {
        count++
    }
}
if count > 1 {
    return errors.New("pass only one of --use_public_ips/--no_use_public_ips")
}

Prevention

Audit CI matrices for duplicate flag injection
Standardize on one public-IP policy per environment

When it happens

Trigger: Passing both --use_public_ips and --no_use_public_ips in the same invocation (isFlagPassed detects both were explicitly provided).

Common situations: Stacked flag lists in CI where one layer adds --use_public_ips and another adds --no_use_public_ips; copy-pasted command lines accumulating both flags.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/affcd1d93b36b86e. Report an issue: GitHub.