{"record":{"id":"c361dd1a123a9bf3","repo":"kubernetes/kops","slug":"unexpected-access-type-in-template-q-s","errorCode":null,"errorMessage":"unexpected access type in template %q: %s","messagePattern":"unexpected access type in template %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/gcetasks/instancetemplate.go","lineNumber":173,"sourceCode":"\n\t\t\tif len(ni.AliasIpRanges) != 0 {\n\t\t\t\tactual.AliasIPRanges = make(map[string]string)\n\t\t\t\tfor _, aliasIPRange := range ni.AliasIpRanges {\n\t\t\t\t\tactual.AliasIPRanges[aliasIPRange.SubnetworkRangeName] = aliasIPRange.IpCidrRange\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif ni.Subnetwork != \"\" {\n\t\t\t\tactual.Subnet = &Subnet{Name: new(lastComponent(ni.Subnetwork))}\n\t\t\t}\n\n\t\t\tacs := ni.AccessConfigs\n\t\t\tif len(acs) > 0 {\n\t\t\t\tif len(acs) != 1 {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unexpected number of access configs in template %q: %d\", *actual.Name, len(acs))\n\t\t\t\t}\n\t\t\t\tif acs[0].Type != accessConfigOneToOneNAT {\n\t\t\t\t\treturn nil, fmt.Errorf(\"unexpected access type in template %q: %s\", *actual.Name, acs[0].Type)\n\t\t\t\t}\n\t\t\t\tactual.HasExternalIP = new(true)\n\t\t\t} else {\n\t\t\t\tactual.HasExternalIP = new(false)\n\t\t\t}\n\t\t}\n\n\t\tfor _, serviceAccount := range p.ServiceAccounts {\n\t\t\tfor _, scope := range serviceAccount.Scopes {\n\t\t\t\tactual.Scopes = append(actual.Scopes, scopeToShortForm(scope))\n\t\t\t}\n\t\t\tactual.ServiceAccounts = append(actual.ServiceAccounts, &ServiceAccount{\n\t\t\t\tEmail: &serviceAccount.Email,\n\t\t\t})\n\t\t}\n\n\t\t// When we deal with additional disks (local disks), we'll need to map them like this...\n\t\t//for i, disk := range p.Disks {","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/gcetasks/instancetemplate.go#L155-L191","documentation":"kOps models external IPs on GCE instance templates assuming the sole access config type is ONE_TO_ONE_NAT. If the matched template's single access config has a different Type value, Find cannot interpret it and returns this error naming the template and the unexpected type string.","triggerScenarios":"An instance template matching the NamePrefix has exactly one access config on its first network interface, but its Type is not \"ONE_TO_ONE_NAT\" — e.g. a manually created template using a different/unrecognized access config type value, or a template produced by newer GCP features/other tooling.","commonSituations":"Hand-edited templates or templates from other IaC tools that set access config types kOps doesn't recognize; experimentation with new GCE networking features that emit different access-config types; corrupted out-of-band edits.","solutions":["Describe the template to confirm the access config type: `gcloud compute instance-templates describe <name>`","Set the access config Type to ONE_TO_ONE_NAT (the standard external-IP config) or remove it entirely if no external IP is wanted","Recreate the template via kOps so the network interface config matches the cluster spec","If the template is not kOps-managed, rename/delete it so it no longer matches the NamePrefix","Upgrade kOps in case support for the new access-config type was added"],"exampleFix":"// before\n\"accessConfig\": [{ \"type\": \"DIRECT_IPV6\", ... }]\n// after\n\"accessConfig\": [{ \"type\": \"ONE_TO_ONE_NAT\", \"networkTier\": \"PREMIUM\" }]\n# or recreate the template with kops update cluster","handlingStrategy":"validation","validationCode":"# Verify access config type on matching templates:\nfor t in $(gcloud compute instance-templates list --format=\"value(name)\" | grep '^<nameprefix>-'); do\n  ty=$(gcloud compute instance-templates describe $t --format=\"value(properties.networkInterfaces[0].accessConfigs[0].type)\")\n  [ -z \"$ty\" ] || [ \"$ty\" = \"ONE_TO_ONE_NAT\" ] || echo \"FAIL: $t accessConfig type=$ty\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use ONE_TO_ONE_NAT access configs (standard external IP) on kOps-managed templates","Make networking changes through the kOps cluster spec, not gcloud/console edits","Audit templates for manual modifications after any out-of-band GCP automation runs","Keep kOps up to date so newly supported access-config types are handled"],"tags":["gce","instance-template","access-config","network"],"backgroundTag":"unsupported-access-config-type","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}