{"record":{"id":"3987b74b67f45a34","repo":"kubernetes/kops","slug":"found-multiple-listeners-matching-v","errorCode":null,"errorMessage":"found multiple listeners matching %+v","messagePattern":"found multiple listeners matching %\\+v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go","lineNumber":97,"sourceCode":"\t\tfor paginator.HasMorePages() {\n\t\t\tpage, err := paginator.NextPage(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error querying for NLB listeners :%v\", err)\n\t\t\t}\n\t\t\tallListeners = append(allListeners, page.Listeners...)\n\t\t}\n\n\t\tvar matches []elbv2types.Listener\n\t\tfor _, listener := range allListeners {\n\t\t\tif aws.ToInt32(listener.Port) == int32(e.Port) {\n\t\t\t\tmatches = append(matches, listener)\n\t\t\t}\n\t\t}\n\t\tif len(matches) == 0 {\n\t\t\treturn nil, nil\n\t\t}\n\t\tif len(matches) > 1 {\n\t\t\treturn nil, fmt.Errorf(\"found multiple listeners matching %+v\", e)\n\t\t}\n\t\tl = &matches[0]\n\t}\n\n\tactual := &NetworkLoadBalancerListener{}\n\tactual.listenerArn = aws.ToString(l.ListenerArn)\n\n\tactual.Port = int(aws.ToInt32(l.Port))\n\tif len(l.Certificates) != 0 {\n\t\tactual.SSLCertificateID = aws.ToString(l.Certificates[0].CertificateArn) // What if there is more then one certificate, can we just grab the default certificate? we don't set it as default, we only set the one.\n\t\tif l.SslPolicy != nil {\n\t\t\tactual.SSLPolicy = aws.ToString(l.SslPolicy)\n\t\t}\n\t}\n\n\t// This will need to be rearranged when we recognized multiple listeners and target groups per NLB\n\tif len(l.DefaultActions) > 0 {\n\t\ttargetGroupARN := l.DefaultActions[0].TargetGroupArn","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go#L79-L115","documentation":"After matching found listeners against the task's desired port/protocol, Find returns this error when more than one listener matches. kOps requires a one-to-one mapping between the NetworkLoadBalancerListener task and an actual AWS listener to compute actual state; ambiguity is treated as a hard error.","triggerScenarios":"Two or more listeners on the same NLB share the same port (and protocol) the task matches on — e.g. duplicate listeners created manually or by a previous buggy apply.","commonSituations":"Manual listener creation in the AWS console duplicating a kOps-managed port; leftover listeners from a prior cluster apply; kOps spec changes that remap ports leaving orphans.","solutions":["List listeners on the NLB (aws elbv2 describe-listeners --load-balancer-arn <arn>) and delete the duplicate for the affected port","Keep exactly one listener per port for kOps-managed NLBs","Re-run kops update cluster after cleanup","If intentional multiple listeners per port are needed (e.g. different TLS policies), model them as separate tasks with distinct match criteria"],"exampleFix":"// before: duplicate listeners on port 443\n// listener-1 :443 TLS, listener-2 :443 TLS (manual)\n// after: remove the manual duplicate\naws elbv2 delete-listener --listener-arn listener-2","handlingStrategy":"validation","validationCode":"// detect duplicates before apply\nseen := map[string]bool{}\nfor _, l := range allListeners {\n  key := fmt.Sprintf(\"%d/%s\", l.Port, l.Protocol)\n  if seen[key] { return fmt.Errorf(\"duplicate listener for %s\", key) }\n  seen[key] = true\n}","typeGuard":null,"tryCatchPattern":"if len(matches) > 1 {\n  return nil, fmt.Errorf(\"found multiple listeners matching %+v\", e)\n}\n// remediate by deleting the duplicate manually, then re-run apply","preventionTips":["Never create console listeners on kOps-managed NLB ports","Prune leftover listeners after changing cluster specs","One listener per port per managed NLB","Audit listeners after failed/interrupted applies"],"tags":["aws","elbv2","listener","ambiguity"],"backgroundTag":"multiple-matching-listeners","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}