{"record":{"id":"35e8da4aa98df222","repo":"kubernetes/kops","slug":"too-many-reservations-returned-for-the-single-inst","errorCode":null,"errorMessage":"too many reservations returned for the single instance-id","messagePattern":"too many reservations returned for the single instance-id","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":494,"sourceCode":"// buildSTSRequestValidator determines the form of a valid STS presigned URL.\nfunc buildSTSRequestValidator(ctx context.Context, stsClient *sts.Client) (*stsRequestValidator, error) {\n\t// We build a presigned token ourselves, primarily to get the expected hostname for the endpoint.\n\tsigned, err := sts.NewPresignClient(stsClient).PresignGetCallerIdentity(ctx, &sts.GetCallerIdentityInput{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"building presigned request: %w\", err)\n\t}\n\tu, err := url.Parse(signed.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing presigned url: %w\", err)\n\t}\n\treturn &stsRequestValidator{Host: u.Host}, nil\n}\n\n// GetInstanceCertificateNames returns the instance names and addresses that should go into\n// certificates: the instance ID, the private DNS name and the IP addresses.\nfunc GetInstanceCertificateNames(instances *ec2.DescribeInstancesOutput) (addrs []string, err error) {\n\tif len(instances.Reservations) != 1 {\n\t\treturn nil, fmt.Errorf(\"too many reservations returned for the single instance-id\")\n\t}\n\n\tif len(instances.Reservations[0].Instances) != 1 {\n\t\treturn nil, fmt.Errorf(\"too many instances returned for the single instance-id\")\n\t}\n\n\tinstance := instances.Reservations[0].Instances[0]\n\n\taddrs = append(addrs, *instance.InstanceId)\n\n\tif instance.PrivateDnsName != nil {\n\t\taddrs = append(addrs, *instance.PrivateDnsName)\n\t}\n\n\t// We only use data for the first interface, and only the first IP\n\tfor _, iface := range instance.NetworkInterfaces {\n\t\tif iface.Attachment == nil {\n\t\t\tcontinue","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L476-L512","documentation":"GetInstanceCertificateNames expects the EC2 DescribeInstances output — queried by instance-id — to contain exactly one reservation. If len(instances.Reservations) != 1 (including zero), the result does not correspond to a single instance lookup and the function refuses to derive certificate names. The message says 'too many' but it also fires when zero reservations come back.","triggerScenarios":"verifyCallerIdentity calls GetInstanceCertificateNames with a DescribeInstancesOutput whose Reservations slice has length 0 (instance not found / not visible) or greater than 1 (query returned multiple reservations).","commonSituations":"The caller identity's instance-id no longer exists (terminated instance racing the check); IAM policies restrict DescribeInstances so the instance is invisible; filtering by instance-id was dropped so the whole account's reservations are returned; instance in a different account/region than the verifier's EC2 client.","solutions":["Ensure DescribeInstances is called with InstanceIds: []string{instanceID} so exactly one reservation is expected","Check the verifier's EC2 client region and credentials can actually see the instance (cross-account/region lookups return empty)","Log len(instances.Reservations) and the caller identity to distinguish the zero-case (not found) from the many-case","Re-run the bootstrap after confirming the instance is running and visible in the target account"],"exampleFix":"// before\nout, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{})\n// after\nout, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n  InstanceIds: []string{instanceID},\n})","handlingStrategy":"validation","validationCode":"if out == nil || len(out.Reservations) != 1 {\n  return fmt.Errorf(\"expected exactly 1 reservation for instance %s, got %d\", instanceID, len(out.Reservations))\n}","typeGuard":"func isSingleReservation(out *ec2.DescribeInstancesOutput) bool {\n  return out != nil && len(out.Reservations) == 1\n}","tryCatchPattern":"addrs, err := GetInstanceCertificateNames(out)\nif err != nil {\n  return fmt.Errorf(\"describing instance %s: %w\", instanceID, err)\n}","preventionTips":["Always call DescribeInstances with InstanceIds: []string{instanceID}","Ensure verifier IAM/region can see the instance in the target account","Treat zero reservations as 'instance not found' and retry bootstrap"],"tags":["aws","ec2","bootstrap","instance-lookup"],"backgroundTag":"unexpected-ec2-describe-result","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}