{"record":{"id":"e4af6e3d7d8a3693","repo":"kubernetes/kops","slug":"found-multiple-tags-for-v-e4af6e","errorCode":null,"errorMessage":"found multiple tags for: %v","messagePattern":"found multiple tags for: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/natgateway.go","lineNumber":173,"sourceCode":"\t\t\treturn nil, nil\n\t\t}\n\t\tfilters = append(filters, awsup.NewEC2Filter(\"resource-id\", *e.Subnet.ID))\n\n\t\trequest := &ec2.DescribeTagsInput{\n\t\t\tFilters: filters,\n\t\t}\n\n\t\tresponse, err := cloud.EC2().DescribeTags(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing tags: %v\", err)\n\t\t}\n\n\t\tif response == nil || len(response.Tags) == 0 {\n\t\t\treturn nil, nil\n\t\t}\n\n\t\tif len(response.Tags) != 1 {\n\t\t\treturn nil, fmt.Errorf(\"found multiple tags for: %v\", e)\n\t\t}\n\t\tt := response.Tags[0]\n\t\tid = t.Value\n\t\tklog.V(2).Infof(\"Found NatGateway via subnet tag: %v\", *id)\n\t}\n\n\tif id != nil {\n\t\treturn findNatGatewayById(ctx, cloud, fi.ValueOf(id))\n\t}\n\n\treturn nil, nil\n}\n\nfunc findNatGatewayById(ctx context.Context, cloud awsup.AWSCloud, id string) (*ec2types.NatGateway, error) {\n\trequest := &ec2.DescribeNatGatewaysInput{}\n\trequest.NatGatewayIds = []string{id}\n\tresponse, err := cloud.EC2().DescribeNatGateways(ctx, request)\n\tif err != nil {","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/natgateway.go#L155-L191","documentation":"findNatGateway looks up a NAT gateway by the subnet's kOps 'AssociatedNatgateway' tag, whose value is the gateway ID. If the DescribeTags API returns more than one tag record for the tag key/filter combination, the code cannot unambiguously pick a value, so it fails rather than guessing.","triggerScenarios":"DescribeTags response for the subnet contains len(Tags) != 1 (typically 2+) — e.g. duplicate tag rows on the subnet matching the AssociatedNatgateway tag key, or a filter that matches both the subnet tag and another resource's tag.","commonSituations":"Clusters where tags were applied twice by retrying provisioning or a manual tag-copy script; hand-edited AWS tags; older clusters migrated between kOps versions that changed tag conventions leaving stale duplicates.","solutions":["Describe the subnet's tags in the AWS console/CLI and delete the duplicate AssociatedNatgateway tag entry so exactly one remains","Use `aws ec2 describe-tags --filters Name=resource-id,Values=<subnet-id>` to identify which resource each duplicate tag belongs to and remove the stale one","Re-run `kops update cluster` after cleanup so Find succeeds and the state is reconciled"],"exampleFix":"// before (duplicate tag on subnet)\naws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-111\naws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-222\n// after (single authoritative tag)\naws ec2 delete-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway\naws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-111","handlingStrategy":"validation","validationCode":"out, err := aws ec2 describe-tags via SDK; count := len(out.Tags)\nif count != 1 { // fix tags before running kops\n  fmt.Printf(\"expected 1 AssociatedNatgateway tag, found %d\\n\", count)\n}","typeGuard":"func singleTag(tags []ec2types.Tag) *ec2types.Tag {\n  if len(tags) == 1 { return &tags[0] }\n  return nil\n}","tryCatchPattern":"gw, err := findNatGateway(ctx, cloud, subnet)\nif err != nil && strings.Contains(err.Error(), \"found multiple tags for\") {\n  // prompt operator to dedupe the subnet's AssociatedNatgateway tag, then retry\n}","preventionTips":["Never apply duplicate AssociatedNatgateway tags to subnets; scripts should upsert, not append","Audit subnet tags after manual AWS console edits","Use AWS Tag Policies to enforce single-valued kops tags"],"tags":["aws","ec2","tags","natgateway"],"backgroundTag":"ambiguous-tag-lookup","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}