expecting exactly 1 network interface IP config for %q, foun

Error message

expecting exactly 1 network interface IP config for %q, found %d: %+v

What it means

Find expects exactly one IP configuration on the single NIC of a kops-managed VMSS, since node networking (subnet, load-balancer pools) is derived from it. Any other count aborts Find; the message names the scale set and includes the actual IP configs.

Source

Thrown at upup/pkg/fi/cloudup/azuretasks/vmscaleset.go:137

		return nil, fmt.Errorf("found VMSS without network profile")
	}
	if found.Properties.VirtualMachineProfile.OSProfile == nil {
		return nil, fmt.Errorf("found VMSS without OS profile")
	}

	profile := found.Properties.VirtualMachineProfile

	nwConfigs := profile.NetworkProfile.NetworkInterfaceConfigurations
	if len(nwConfigs) != 1 {
		return nil, fmt.Errorf("expecting exactly 1 network interface config for %q, found %d: %+v", *s.Name, len(nwConfigs), nwConfigs)
	}
	nwConfig := nwConfigs[0]
	if nwConfig.Properties == nil {
		return nil, fmt.Errorf("found VMSS without network interface config properties")
	}
	ipConfigs := nwConfig.Properties.IPConfigurations
	if len(ipConfigs) != 1 {
		return nil, fmt.Errorf("expecting exactly 1 network interface IP config for %q, found %d: %+v", *s.Name, len(ipConfigs), ipConfigs)
	}
	ipConfig := ipConfigs[0]
	if ipConfig.Properties == nil {
		return nil, fmt.Errorf("found VMSS without IP config properties")
	}
	if ipConfig.Properties.Subnet == nil {
		return nil, fmt.Errorf("found VMSS without IP config subnet")
	}
	if ipConfig.Properties.Subnet.ID == nil {
		return nil, fmt.Errorf("found VMSS without IP config subnet ID")
	}
	subnetID, err := azure.ParseSubnetID(*ipConfig.Properties.Subnet.ID)
	if err != nil {
		return nil, fmt.Errorf("failed to parse subnet ID %s", *ipConfig.Properties.Subnet.ID)
	}

	var loadBalancerID *azure.LoadBalancerID
	if ipConfig.Properties.LoadBalancerBackendAddressPools != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Inspect the VMSS NIC IP configurations and reduce to exactly one (az vmss show).
Delete the modified VMSS and re-apply with kops to restore the expected single IP config.
Fix fixtures so IPConfigurations contains exactly one entry.
Route extra-IP requirements through kops cluster spec instead of editing the VMSS directly.

Example fix

// before (fixture)
ipConfigs := []*compute.VirtualMachineScaleSetIPConfiguration{ipA, ipB}
// after
ipConfigs := []*compute.VirtualMachineScaleSetIPConfiguration{ipA}

Defensive patterns

Strategy: validation

Validate before calling

ips := nic.Properties.IPConfigurations
if ips == nil || len(ips) != 1 {
    return fmt.Errorf("VMSS NIC must have exactly 1 IP config, found %d", len(ips))
}

Type guard

func hasSingleIPConfig(nic *compute.VirtualMachineScaleSetNetworkConfiguration) bool {
    return nic != nil && nic.Properties != nil && len(nic.Properties.IPConfigurations) == 1
}

Try / catch

found, err := task.Find(ctx, cloud)
if err != nil {
    if strings.Contains(err.Error(), "exactly 1 network interface IP config") {
        return restoreSingleIPConfig(err)
    }
    return err
}

Prevention

Avoid manually adding secondary IP configurations to node VMSS NICs.
Request additional IPs through the kops cluster spec instead.
Fixtures must contain exactly one IPConfiguration.

When it happens

Trigger: nwConfig.Properties.IPConfigurations has length != 1 — extra IP configurations added (e.g. multiple private IPs / secondary LB pools) or none present.

Common situations: Manual addition of secondary IPs for containers/ingress; external tooling attaching extra IP configs; empty mocks.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6585328e539ffda8. Report an issue: GitHub.