{"record":{"id":"e4af4429015455f5","repo":"kubernetes/kops","slug":"found-multiple-vpcs-matching-tags","errorCode":null,"errorMessage":"found multiple VPCs matching tags","messagePattern":"found multiple VPCs matching tags","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc.go","lineNumber":92,"sourceCode":"\n\trequest := &ec2.DescribeVpcsInput{}\n\n\tif fi.ValueOf(e.ID) != \"\" {\n\t\trequest.VpcIds = []string{aws.ToString(e.ID)}\n\t} else {\n\t\trequest.Filters = cloud.BuildFilters(e.Name)\n\t}\n\n\tresponse, err := cloud.EC2().DescribeVpcs(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing VPCs: %v\", err)\n\t}\n\tif response == nil || len(response.Vpcs) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tif len(response.Vpcs) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple VPCs matching tags\")\n\t}\n\tvpc := response.Vpcs[0]\n\tactual := &VPC{\n\t\tID:         vpc.VpcId,\n\t\tCIDR:       vpc.CidrBlock,\n\t\tAmazonIPv6: aws.Bool(false),\n\t\tName:       findNameTag(vpc.Tags),\n\t\tTags:       intersectTags(vpc.Tags, e.Tags),\n\t}\n\n\tklog.V(4).Infof(\"found matching VPC %v\", actual)\n\n\tfor _, association := range vpc.Ipv6CidrBlockAssociationSet {\n\t\tif association.Ipv6CidrBlockState == nil {\n\t\t\tcontinue\n\t\t}\n\n\t\tstate := association.Ipv6CidrBlockState.State","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc.go#L74-L110","documentation":"After DescribeVpcs, VPC.Find expects exactly one match (either by ID or by kops name tag filters); if more than one VPC is returned it refuses to guess and returns this error. This protects against mutating the wrong VPC.","triggerScenarios":"Multiple VPCs share the same kops tag (e.g. KubernetesCluster=<cluster>) — typically from a duplicated/re-created cluster with the same name in the same account/region, or a manual filter in the spec matching several VPCs.","commonSituations":"Recreating a cluster with the same name before the old VPC was deleted; running kOps against an account with leftover test clusters sharing the cluster name tag; reusing a cluster name across environments in one account.","solutions":["Find the duplicate VPCs (aws ec2 describe-vpcs --filters Name=tag:KubernetesCluster,Values=<name>) and delete the stale one","Use a unique cluster name per account/region going forward","If a VPC is intentionally shared, configure kOps to use the shared VPC (vpc id in the spec) rather than tag matching"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before apply, assert exactly one VPC carries the cluster tag\ndupes := []string{}\nout, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{Filters: []types.Filter{{Name: aws.String(\"tag:KubernetesCluster\"), Values: []string{clusterName}}}})\nfor _, v := range out.Vpcs { dupes = append(dupes, *v.VpcId) }\nif len(dupes) > 1 { return fmt.Errorf(\"duplicate VPCs with cluster tag: %v\", dupes) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never reuse a cluster name in the same account/region until the old VPC is deleted","Audit for stale clusters sharing the KubernetesCluster tag","Use explicit shared-VPC config (vpc id in spec) when importing existing VPCs","Clean up failed applies before re-running with the same name"],"tags":["aws","vpc","duplicate-resources","tag-collision"],"backgroundTag":"multiple-resources-matched","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}