cannot set more than one EgressOnlyInternetGateway, Internet

Error message

cannot set more than one EgressOnlyInternetGateway, InternetGateway, Instance, NatGateway, TransitGateway, or VpcPeeringConnection

What it means

This error is raised in Route task CheckChanges when more than one route target is specified. AWS routes allow exactly one target per route, so kOps counts the populated target fields (EgressOnlyInternetGateway, InternetGateway, Instance, NatGateway, TransitGateway, VPCPeeringConnection) and rejects any count above one.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/route.go:171

			targetCount++
		}
		if e.Instance != nil {
			targetCount++
		}
		if e.NatGateway != nil {
			targetCount++
		}
		if e.TransitGatewayID != nil {
			targetCount++
		}
		if e.VPCPeeringConnectionID != nil {
			targetCount++
		}
		if targetCount == 0 {
			return fmt.Errorf("EgressOnlyInternetGateway, InternetGateway, Instance, NatGateway, TransitGateway, or VpcPeeringConnection is required")
		}
		if targetCount != 1 {
			return fmt.Errorf("cannot set more than one EgressOnlyInternetGateway, InternetGateway, Instance, NatGateway, TransitGateway, or VpcPeeringConnection")
		}
	}

	if a != nil {
		if changes.RouteTable != nil {
			return fi.CannotChangeField("RouteTable")
		}
		if changes.CIDR != nil {
			return fi.CannotChangeField("CIDR")
		}
		if changes.IPv6CIDR != nil {
			return fi.CannotChangeField("IPv6CIDR")
		}
	}
	return nil
}

func (_ *Route) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *Route) error {

View on GitHub (pinned to 4c8573c808)

Solutions

Keep only one target field and remove the others
Split traffic across separate routes with distinct destination CIDRs if multiple paths are genuinely needed
Regenerate the manifest to clear conflicting fields

Example fix

// before
route:
  cidr: 0.0.0.0/0
  internetGateway: igw-1
  natGateway: nat-1
// after
route:
  cidr: 0.0.0.0/0
  internetGateway: igw-1

Defensive patterns

Strategy: validation

Validate before calling

func targetCount(r Route) int {
	n := 0
	for _, t := range []*string{r.EgressOnlyInternetGatewayID, r.InternetGatewayID, r.InstanceID, r.NatGatewayID, r.TransitGatewayID, r.VPCPeeringConnectionID} {
		if t != nil { n++ }
	}
	return n
}
if targetCount(route) > 1 { return errors.New("route allows at most one target") }

Prevention

Enforce exactly-one-target in any manifest generator you build
Avoid merging route stanzas from multiple sources without conflict detection

When it happens

Trigger: Setting two or more of the target fields on the same Route task, e.g. both internetGateway and natGateway.

Common situations: Merging route definitions from two sources; copy-paste errors adding a second target; misunderstanding that fallback/multiple targets are supported.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/47021ea46c56ea46. Report an issue: GitHub.