{"record":{"id":"028b01d64ddb4f84","repo":"kubernetes/kops","slug":"unexpected-number-of-access-configs-in-template-q","errorCode":null,"errorMessage":"unexpected number of access configs in template %q: %d","messagePattern":"unexpected number of access configs in template %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/instancetemplate.go","lineNumber":170,"sourceCode":"\t\t\tif ni.StackType != \"\" {\n\t\t\t\tactual.StackType = &ni.StackType\n\t\t\t}\n\n\t\t\tif len(ni.AliasIpRanges) != 0 {\n\t\t\t\tactual.AliasIPRanges = make(map[string]string)\n\t\t\t\tfor _, aliasIPRange := range ni.AliasIpRanges {\n\t\t\t\t\tactual.AliasIPRanges[aliasIPRange.SubnetworkRangeName] = aliasIPRange.IpCidrRange\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif ni.Subnetwork != \"\" {\n\t\t\t\tactual.Subnet = &Subnet{Name: new(lastComponent(ni.Subnetwork))}\n\t\t\t}\n\n\t\t\tacs := ni.AccessConfigs\n\t\t\tif len(acs) > 0 {\n\t\t\t\tif len(acs) != 1 {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unexpected number of access configs in template %q: %d\", *actual.Name, len(acs))\n\t\t\t\t}\n\t\t\t\tif acs[0].Type != accessConfigOneToOneNAT {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unexpected access type in template %q: %s\", *actual.Name, acs[0].Type)\n\t\t\t\t}\n\t\t\t\tactual.HasExternalIP = new(true)\n\t\t\t} else {\n\t\t\t\tactual.HasExternalIP = new(false)\n\t\t\t}\n\t\t}\n\n\t\tfor _, serviceAccount := range p.ServiceAccounts {\n\t\t\tfor _, scope := range serviceAccount.Scopes {\n\t\t\t\tactual.Scopes = append(actual.Scopes, scopeToShortForm(scope))\n\t\t\t}\n\t\t\tactual.ServiceAccounts = append(actual.ServiceAccounts, &ServiceAccount{\n\t\t\t\tEmail: &serviceAccount.Email,\n\t\t\t})\n\t\t}","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/instancetemplate.go#L152-L188","documentation":"When reading back a matching instance template, kOps only models zero or one access config per network interface (absence = no external IP; exactly one ONE_TO_ONE_NAT = external IP). If the discovered template has more than one access config on its first network interface, the state can't be represented, so Find aborts with this error naming the template and count.","triggerScenarios":"An instance template matching the task's NamePrefix was created or edited out-of-band with multiple access configs on network interface 0 (e.g. multiple external IPs, or both IPv4 and IPv6 ephemeral access configs added manually).","commonSituations":"Manual gcloud/console edits adding a second external IP; templates generated by other automation attaching several NAT configs; dual-stack experimentation adding an extra access config alongside the existing one.","solutions":["Identify the template (name is printed in the error) and inspect it: `gcloud compute instance-templates describe <name>`","Remove the extra access configs so the first network interface has at most one ONE_TO_ONE_NAT config","Recreate the template through kOps so its network config matches the cluster spec","If the template isn't managed by kOps, rename or delete it so it no longer matches the NamePrefix"],"exampleFix":"// before: two access configs on ni[0]\n// after: keep exactly one\n# recreate template via kops, or:\ngcloud compute instance-templates create <name> ... --network-interface=...,access-config=  # single access config only","handlingStrategy":"validation","validationCode":"# Assert no managed template has more than one access config:\nfor t in $(gcloud compute instance-templates list --format=\"value(name)\" | grep '^<nameprefix>-'); do\n  n=$(gcloud compute instance-templates describe $t --format=\"value(properties.networkInterfaces[0].accessConfigs.len())\")\n  [ \"$n\" -le 1 ] || echo \"FAIL: $t has $n access configs\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not add extra access configs (multiple external IPs) to kOps-managed templates","Configure external IP presence solely via the kOps spec's HasExternalIP setting","Keep dual-stack/IPv6 changes inside the supported StackType field of the kOps spec","Rename out-of-band templates so they don't collide with the kOps NamePrefix"],"tags":["gce","instance-template","access-config","external-ip","unsupported-config"],"backgroundTag":"unsupported-access-config-count","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}