{"record":{"id":"ea81976fa1a78073","repo":"kubernetes/kops","slug":"found-multiple-role-tags-q-vs-q","errorCode":null,"errorMessage":"Found multiple role tags: %q vs %q","messagePattern":"Found multiple role tags: %q vs %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/autoscalinggroup.go","lineNumber":1014,"sourceCode":"\t\t}\n\t} else if e.LaunchTemplate != nil {\n\t\ttf.LaunchTemplate = &terraformAutoscalingLaunchTemplateSpecification{\n\t\t\tLaunchTemplateID: e.LaunchTemplate.TerraformLink(),\n\t\t\tVersion:          e.LaunchTemplate.VersionLink(),\n\t\t}\n\t} else {\n\t\treturn fmt.Errorf(\"could not find one of launch configuration, mixed instances policy, or launch template\")\n\t}\n\n\trole := \"\"\n\tfor k := range e.Tags {\n\t\tif strings.HasPrefix(k, CloudTagInstanceGroupRolePrefix) {\n\t\t\tsuffix := strings.TrimPrefix(k, CloudTagInstanceGroupRolePrefix)\n\t\t\tif suffix == \"control-plane\" {\n\t\t\t\tsuffix = \"master\"\n\t\t\t}\n\t\t\tif role != \"\" && role != suffix {\n\t\t\t\treturn fmt.Errorf(\"Found multiple role tags: %q vs %q\", role, suffix)\n\t\t\t}\n\t\t\trole = suffix\n\t\t}\n\t}\n\n\tif e.LaunchTemplate != nil && role != \"\" {\n\t\tfor _, sg := range e.LaunchTemplate.SecurityGroups {\n\t\t\tif err := t.AddOutputVariableArray(role+\"_security_group_ids\", sg.TerraformLink()); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tif role != \"\" {\n\t\tif err := t.AddOutputVariableArray(role+\"_autoscaling_group_ids\", e.TerraformLink()); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tif role == \"node\" {","sourceCodeStart":996,"sourceCodeEnd":1032,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/autoscalinggroup.go#L996-L1032","documentation":"Raised while computing the role from ASG tags in the Terraform render path: the ASG carries more than one kops instance-group role tag (prefix k8s.io/cluster-autoscaler/... role prefix) with conflicting role suffixes. kops uses this tag to link the ASG to a role and refuses ambiguous configurations.","triggerScenarios":"Iterating e.Tags, two tags with the CloudTagInstanceGroupRolePrefix yield different suffixes (e.g. .../role/node vs .../role/bastion) on the same ASG task.","commonSituations":"Manually copied tags between ASGs; a cluster rename left old role tags alongside new ones; a script added per-role tags to a shared ASG; merging instance groups left stale tags.","solutions":["Inspect ASG tags (`aws autoscaling describe-tags --filters Name=resource-id,Values=<asg-name>`) and remove the conflicting role tag so only one remains.","Re-apply with kops so desired tags are reconciled after manual cleanup.","If the ASG genuinely serves two roles, split it into separate instance groups with one role tag each.","Check the cluster spec cloudLabels/instance group role configuration for accidental duplicates."],"exampleFix":"// before: two role tags on one ASG\nk8s.io/role/node: \"1\"\nk8s.io/role/bastion: \"1\"\n// after: keep only the matching role\nk8s.io/role/node: \"1\"","handlingStrategy":"validation","validationCode":"// pre-check ASG role tags for conflicts\nroles := map[string]bool{}\nfor k := range asgTags {\n  if strings.HasPrefix(k, \"k8s.io/role/\") {\n    roles[strings.TrimPrefix(k, \"k8s.io/role/\")] = true\n  }\n}\nif len(roles) > 1 { return fmt.Errorf(\"ASG %s has conflicting role tags: %v\", name, roles) }","typeGuard":null,"tryCatchPattern":"if err := render(); err != nil {\n  if strings.Contains(err.Error(), \"Found multiple role tags\") {\n    return fmt.Errorf(\"clean duplicate k8s.io/role/* tags on the ASG, then re-apply: %w\", err)\n  }\n  return err\n}","preventionTips":["Never copy role tags between ASGs manually.","After cluster renames, purge stale k8s.io/role/* tags.","One instance group = one role tag."],"tags":["kops","tags","autoscaling","configuration"],"backgroundTag":"conflicting-tags","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}