kubernetes/kops · error

expected exactly one container in etcd-manager Pod, found %d

Error message

expected exactly one container in etcd-manager Pod, found %d

What it means

buildHealthcheckSidecar requires the etcd-manager healthcheck Pod template to contain exactly one container so it can inject the sidecar and remap its image via AssetBuilder. If pod.Spec.Containers has any count other than 1, it fails with this error. Like the previous checks, this validates the integrity of the embedded bundle template.

Source

Thrown at pkg/model/components/kubeapiserver/model.go:136

	var pod *corev1.Pod
	var container *corev1.Container
	{
		objects, err := model.ParseManifest(manifest)
		if err != nil {
			return nil, err
		}
		if len(objects) != 1 {
			return nil, fmt.Errorf("expected exactly one object in manifest %s, found %d", bundle, len(objects))
		}
		if podObject, ok := objects[0].(*corev1.Pod); !ok {
			return nil, fmt.Errorf("expected Pod object in manifest %s, found %T", bundle, objects[0])
		} else {
			pod = podObject
		}

		if len(pod.Spec.Containers) != 1 {
			return nil, fmt.Errorf("expected exactly one container in etcd-manager Pod, found %d", len(pod.Spec.Containers))
		}
		container = &pod.Spec.Containers[0]
	}

	// Remap image via AssetBuilder
	container.Image = b.AssetBuilder.RemapImage(container.Image)

	return pod, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use an official kOps release where the sidecar Pod template has exactly one container
2. Fix the custom bundle so the Pod has a single container
3. Diff your bundle against the upstream one to spot added/removed containers
4. Upgrade kOps if an upstream regression changed the template

Example fix

// before (bundle Pod spec)
containers:
- name: etcd-manager
- name: extra
// after
containers:
- name: etcd-manager

// Check container count in the sidecar Pod before model build
pod, err := asPod(objects[0])
if err != nil || pod == nil {
    return fmt.Errorf("bundle is not a Pod")
}
if len(pod.Spec.Containers) != 1 {
    return fmt.Errorf("sidecar Pod must have exactly one container, got %d", len(pod.Spec.Containers))
}

pod, err := buildHealthcheckSidecar(ctx, b, bundle)
if err != nil {
    if strings.Contains(err.Error(), "expected exactly one container") {
        return fmt.Errorf("sidecar bundle template changed — use official kOps: %w", err)
    }
    return err
}

When it happens

Trigger: kops update cluster where the embedded sidecar Pod template defines 0 or multiple containers — corrupted or hand-edited bundle in a custom kOps build.

Common situations: Custom builds with edited pod templates, or upstream regressions changing the bundled template shape.

Related errors

• expected exactly one object in manifest %s, found %d
• expected Pod object in manifest %s, found %T
• error reading certificate %q: %v
• error listening on %q: %v
• unexpected return from ListenAndServe

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/67eb927f5a410200. Report an issue: GitHub.