{"record":{"id":"affcd1d93b36b86e","repo":"apache/beam","slug":"exactly-one-of-usepublicips-and-nousepublicips-must-be-true","errorCode":null,"errorMessage":"exactly one of usePublicIPs and noUsePublicIPs must be true, please check that only one is true","messagePattern":"exactly one of usePublicIPs and noUsePublicIPs must be true, please check that only one is true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdks/go/pkg/beam/runners/dataflow/dataflow.go","lineNumber":329,"sourceCode":"\t}\n\tif !*update && *transformMapping != \"\" {\n\t\treturn nil, errors.New(\"provided transform_name_mapping without setting the --update flag, so the pipeline would not be updated\")\n\t}\n\tvar updateTransformMapping map[string]string\n\tif *transformMapping != \"\" {\n\t\tif err := json.Unmarshal([]byte(*transformMapping), &updateTransformMapping); err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"error reading --transform_name_mapping flag as JSON\")\n\t\t}\n\t}\n\tif *usePublicIPs == *noUsePublicIPs {\n\t\tuseSet := isFlagPassed(\"use_public_ips\")\n\t\tnoUseSet := isFlagPassed(\"no_use_public_ips\")\n\t\t// If use_public_ips was explicitly set but no_use_public_ips was not, use that value\n\t\t// We take the explicit value of no_use_public_ips if it was set but use_public_ips was not.\n\t\tif useSet && !noUseSet {\n\t\t\t*noUsePublicIPs = !*usePublicIPs\n\t\t} else if useSet && noUseSet {\n\t\t\treturn nil, errors.New(\"exactly one of usePublicIPs and noUsePublicIPs must be true, please check that only one is true\")\n\t\t}\n\t}\n\n\thooks.SerializeHooksToOptions()\n\n\texperiments := jobopts.GetExperiments()\n\t// Ensure that we enable the same set of experiments across all SDKs\n\t// for Dataflow Portable Runner.\n\tvar fnApiSet, v2set, uwSet, portaSubmission, seSet, wsSet bool\n\tfor _, e := range experiments {\n\t\tif strings.Contains(e, \"beam_fn_api\") {\n\t\t\tfnApiSet = true\n\t\t}\n\t\tif strings.Contains(e, \"use_runner_v2\") {\n\t\t\tv2set = true\n\t\t}\n\t\tif strings.Contains(e, \"use_unified_worker\") {\n\t\t\tuwSet = true","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/runners/dataflow/dataflow.go#L311-L347","documentation":"The Dataflow runner exposes --use_public_ips and --no_use_public_ips to control worker network addressing. Both being explicitly set is contradictory, so getJobOptions returns this error when both flags were passed on the command line.","triggerScenarios":"Passing both --use_public_ips and --no_use_public_ips in the same invocation (isFlagPassed detects both were explicitly provided).","commonSituations":"Stacked flag lists in CI where one layer adds --use_public_ips and another adds --no_use_public_ips; copy-pasted command lines accumulating both flags.","solutions":["Remove one of the two flags so only one public-IP preference is set","Audit CI/launch scripts for duplicated conflicting flags (e.g. grep the command line)","Pick the security-preferred default (--no_use_public_ips) when a VPC with Private Google Access is available"],"exampleFix":"// before\n--use_public_ips --no_use_public_ips\n// after\n--no_use_public_ips","handlingStrategy":"validation","validationCode":"count := 0\nfor _, f := range os.Args {\n    if f == \"--use_public_ips\" || f == \"--no_use_public_ips\" {\n        count++\n    }\n}\nif count > 1 {\n    return errors.New(\"pass only one of --use_public_ips/--no_use_public_ips\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit CI matrices for duplicate flag injection","Standardize on one public-IP policy per environment"],"tags":["go","dataflow","cli-flag","conflicting-flags"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}