kubernetes/kops · error

cannot specify both %q and %q for forwarding rule target.

Error message

cannot specify both %q and %q for forwarding rule target.

What it means

RenderGCE builds the GCE ForwardingRule object and sets Target from either a TargetPool or a BackendService. GCE forwarding rules accept only one target, so if a TargetPool already produced a Target URL and a BackendService is also set, this validation error fires before any API call. It is a spec conflict, caught locally.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/forwardingrule.go:180

	}
	if e.PortRange != nil {
		o.PortRange = *e.PortRange
	}
	if len(e.Ports) > 0 {
		o.Ports = e.Ports
	}

	if e.LoadBalancingScheme != nil {
		o.LoadBalancingScheme = *e.LoadBalancingScheme
	}

	if e.TargetPool != nil {
		o.Target = e.TargetPool.URL(t.Cloud)
	}

	if e.BackendService != nil {
		if o.Target != "" {
			return fmt.Errorf("cannot specify both %q and %q for forwarding rule target.", o.Target, e.BackendService)
		}
		o.BackendService = e.BackendService.URL(t.Cloud)
	}

	if e.IPAddress != nil {
		o.IPAddress = fi.ValueOf(e.IPAddress.IPAddress)
		if o.IPAddress == "" {
			addr, err := e.IPAddress.find(t.Cloud)
			if err != nil {
				return fmt.Errorf("error finding Address %q: %v", e.IPAddress, err)
			}
			if addr == nil {
				return fmt.Errorf("Address %q was not found", e.IPAddress)
			}

			o.IPAddress = fi.ValueOf(addr.IPAddress)
			if o.IPAddress == "" {
				return fmt.Errorf("Address had no IP: %v", e.IPAddress)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove the targetPool field from the ForwardingRule spec if using a BackendService.
2. Alternatively remove backendService if the legacy TargetPool is intended.
3. Regenerate the manifest (kops edit cluster / kops update) to ensure only one target is set.
4. For migration, delete and recreate the forwarding rule with the new target type rather than specifying both.

Example fix

// before
targetPool: api-target-pool
backendService: api-backend
// after
backendService: api-backend

func validateForwardingRuleTarget(fr *ForwardingRuleSpec) error {
  set := 0
  if fr.TargetPool != nil { set++ }
  if fr.BackendService != nil { set++ }
  if set > 1 {
    return errors.New("forwarding rule must specify exactly one of targetPool or backendService")
  }
  return nil
}

When it happens

Trigger: A ForwardingRule task in the cluster spec has both targetPool and backendService populated; RenderGCE is called during kops update/apply.

Common situations: Migrating a cluster from target-pool-based load balancing to backend-service-based (or vice versa) while the old field was left populated; copy-paste of spec fragments; merge conflicts in the cluster manifest.

Related errors

• unknown load balancer Type: %q
• providerID %q not recognized for node %s
• error getting ForwardingRule %q: %w
• Invalid service account email '%s'
• failed to list backend services: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b000e47c4eb49e89. Report an issue: GitHub.