{"record":{"id":"ff00fbd9162e7e44","repo":"kubernetes/kops","slug":"found-multiple-instances-with-instance-id-s","errorCode":null,"errorMessage":"found multiple instances with instance id: %s","messagePattern":"found multiple instances with instance id: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/bootstrap/awsbootstrap/verifier.go","lineNumber":305,"sourceCode":"\t\t}\n\t}\n\tif !found {\n\t\treturn nil, fmt.Errorf(\"arn %q does not contain acceptable node role\", arn)\n\t}\n\n\tinstanceID := resource[2]\n\tinstances, err := a.ec2.DescribeInstances(ctx, &ec2.DescribeInstancesInput{\n\t\tInstanceIds: []string{instanceID},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"describing instance for arn %q\", arn)\n\t}\n\n\tif len(instances.Reservations) <= 0 || len(instances.Reservations[0].Instances) <= 0 {\n\t\treturn nil, fmt.Errorf(\"missing instance id: %s\", instanceID)\n\t}\n\tif len(instances.Reservations[0].Instances) > 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple instances with instance id: %s\", instanceID)\n\t}\n\n\tinstance := instances.Reservations[0].Instances[0]\n\n\taddrs, err := GetInstanceCertificateNames(instances)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar challengeEndpoints []string\n\tfor _, nic := range instance.NetworkInterfaces {\n\t\tif ip := aws.ToString(nic.PrivateIpAddress); ip != \"\" {\n\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t}\n\t\tfor _, a := range nic.PrivateIpAddresses {\n\t\t\tif ip := aws.ToString(a.PrivateIpAddress); ip != \"\" {\n\t\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(ip, strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t\t}","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/bootstrap/awsbootstrap/verifier.go#L287-L323","documentation":"During node bootstrap verification, kOps looks up the instance that made the STS GetCallerIdentity call via ec2.DescribeInstances with the instance ID extracted from the assumed-role ARN. AWS guarantees instance IDs are unique, so DescribeInstances returning more than one instance for a single ID is an invariant violation the verifier refuses to guess its way through. It throws this to avoid issuing certificates against the wrong machine.","triggerScenarios":"verifyCallerIdentity (via verifyTokenV1/verifyTokenV2) calls ec2.DescribeInstances(InstanceIds=[instanceID]) and the response contains len(Reservations[0].Instances) > 1 — i.e. EC2 returned multiple instance entries for the single requested ID.","commonSituations":"Almost always an AWS API/SDK anomaly or a mocked/stubbed EC2 backend returning malformed reservations rather than a user misconfiguration; seen occasionally with regional STS endpoints paired with buggy EC2 responses, or in fake/ mocks used in tests where the DescribeInstances stub returns duplicate instances.","solutions":["Retry the bootstrap token verification; a transient EC2 API anomaly usually resolves on a fresh DescribeInstances call.","Check the AWS account/region for duplicate resources or an EC2 API proxy/interceptor that could duplicate reservation entries.","If using a mocked EC2 endpoint (tests, LocalStack), fix the mock so one instance ID maps to exactly one instance.","Check the kOps version for known issues and upgrade if the error persists on every bootstrap attempt."],"exampleFix":"// For test stubs that triggered the error:\n// before\nreturn &ec2.DescribeInstancesOutput{Reservations: []types.Reservation{\n  {Instances: []types.Instance{inst, inst}},\n}}\n// after\nreturn &ec2.DescribeInstancesOutput{Reservations: []types.Reservation{\n  {Instances: []types.Instance{inst}},\n}}","handlingStrategy":"retry","validationCode":"out, err := ec2Client.DescribeInstances(ctx, &ec2.DescribeInstancesInput{InstanceIds: []string{instanceID}})\nif err != nil { return err }\nn := 0\nfor _, r := range out.Reservations { n += len(r.Instances) }\nif n == 0 { return fmt.Errorf(\"instance %s not found yet\", instanceID) }\nif n > 1 { return fmt.Errorf(\"ambiguous DescribeInstances response for %s\", instanceID) }","typeGuard":"func exactlyOneInstance(out *ec2.DescribeInstancesOutput) (types.Instance, bool) {\n  var inst []types.Instance\n  for _, r := range out.Reservations { inst = append(inst, r.Instances...) }\n  if len(inst) != 1 { return types.Instance{}, false }\n  return inst[0], true\n}","tryCatchPattern":"for attempt := 0; attempt < 3; attempt++ {\n  result, err := verifier.VerifyToken(ctx, token)\n  if err != nil && strings.Contains(err.Error(), \"found multiple instances\") {\n    time.Sleep(backoff(attempt)); continue // transient EC2 API anomaly\n  }\n  return result, err\n}","preventionTips":["Retry verification once before failing a node bootstrap; transient duplicate responses self-heal.","In test mocks/LocalStack, ensure one instance ID maps to exactly one reservation instance.","Keep kOps and AWS SDK versions current to pick up EC2 API anomaly fixes."],"tags":["aws","ec2","bootstrap","invariant-violation"],"backgroundTag":"duplicate-ec2-instance-response","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}