expecting exactly 1 network interface config for %q, found %

Error message

expecting exactly 1 network interface config for %q, found %d: %+v

What it means

kops models each VMSS node group with exactly one network interface configuration; Find enforces this by erroring when the found scale set has any other count. The message includes the scale set name, found count, and the full configs for diagnosis.

Source

Thrown at upup/pkg/fi/cloudup/azuretasks/vmscaleset.go:129

	if fi.ValueOf(found.Properties.ProvisioningState) == "Failed" {
		klog.Warningf("found VMSS %q in failed provisioning state", *s.Name)
		return nil, nil
	}
	if found.Properties.VirtualMachineProfile == nil {
		return nil, fmt.Errorf("found VMSS without VM profile")
	}
	if found.Properties.VirtualMachineProfile.NetworkProfile == nil {
		return nil, fmt.Errorf("found VMSS without network profile")
	}
	if found.Properties.VirtualMachineProfile.OSProfile == nil {
		return nil, fmt.Errorf("found VMSS without OS profile")
	}

	profile := found.Properties.VirtualMachineProfile

	nwConfigs := profile.NetworkProfile.NetworkInterfaceConfigurations
	if len(nwConfigs) != 1 {
		return nil, fmt.Errorf("expecting exactly 1 network interface config for %q, found %d: %+v", *s.Name, len(nwConfigs), nwConfigs)
	}
	nwConfig := nwConfigs[0]
	if nwConfig.Properties == nil {
		return nil, fmt.Errorf("found VMSS without network interface config properties")
	}
	ipConfigs := nwConfig.Properties.IPConfigurations
	if len(ipConfigs) != 1 {
		return nil, fmt.Errorf("expecting exactly 1 network interface IP config for %q, found %d: %+v", *s.Name, len(ipConfigs), ipConfigs)
	}
	ipConfig := ipConfigs[0]
	if ipConfig.Properties == nil {
		return nil, fmt.Errorf("found VMSS without IP config properties")
	}
	if ipConfig.Properties.Subnet == nil {
		return nil, fmt.Errorf("found VMSS without IP config subnet")
	}
	if ipConfig.Properties.Subnet.ID == nil {
		return nil, fmt.Errorf("found VMSS without IP config subnet ID")

View on GitHub (pinned to 4c8573c808)

Solutions

Inspect the VMSS (az vmss show) and remove extra NIC configurations so exactly one remains.
Delete the divergent VMSS and run kops apply to recreate it per the cluster spec.
Ensure test fixtures return exactly one NetworkInterfaceConfiguration.
Manage the VMSS only through kops to prevent spec drift.

Example fix

// before (fixture)
nics := []*compute.VirtualMachineScaleSetNetworkConfiguration{}
// after
nics := []*compute.VirtualMachineScaleSetNetworkConfiguration{ {Name: &nicName, ...} }

Defensive patterns

Strategy: validation

Validate before calling

nics := vmss.Properties.VirtualMachineProfile.NetworkProfile.NetworkInterfaceConfigurations
if nics == nil || len(nics) != 1 {
    return fmt.Errorf("VMSS must have exactly 1 NIC config, found %d", len(nics))
}

Type guard

func hasSingleNIC(v *compute.VirtualMachineScaleSet) bool {
    if v == nil || v.Properties == nil || v.Properties.VirtualMachineProfile == nil ||
        v.Properties.VirtualMachineProfile.NetworkProfile == nil {
        return false
    }
    return len(v.Properties.VirtualMachineProfile.NetworkProfile.NetworkInterfaceConfigurations) == 1
}

Try / catch

found, err := task.Find(ctx, cloud)
if err != nil {
    var nf *NICCountError
    if errors.As(err, &nf) {
        return replaceScaleSetWithSpec(err)
    }
    return err
}

Prevention

Do not attach secondary NICs to kops-managed node scale sets.
Check for drift with kops get/apply --dry-run before changes.
Return exactly one NIC configuration from fixtures.

When it happens

Trigger: profile.NetworkProfile.NetworkInterfaceConfigurations has length != 1 — e.g. someone added a second NIC to the scale set, or a fixture returns zero/multiple NIC configs.

Common situations: Manual edits or external IaC adding extra NICs (e.g. for private connectivity); migrating a VMSS from another tool that used multiple NICs; mock returning empty NIC list.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f2f3844f728efd7b. Report an issue: GitHub.