found multiple instances with id %v managed by mig %s

Error message

found multiple instances with id %v managed by mig %s

What it means

After listing a MIG's members and filtering by instance ID, more than one instance matched. GCE guarantees instance IDs are unique within a project, so this indicates kops' filtering or post-filtering logic failed. The code comments explicitly note this should be impossible.

Source

Thrown at pkg/nodeidentity/gce/identify.go:267

	if err := i.computeService.InstanceGroupManagers.ListManagedInstances(i.project, zone, mig.Name).Filter(filter).Pages(ctx, func(page *compute.InstanceGroupManagersListManagedInstancesResponse) error {
		// Post-filter... filters aren't implemented (b/27605549)
		for _, instance := range page.ManagedInstances {
			if instance.Id != instanceID {
				continue
			}
			matches = append(matches, instance)
		}
		return nil
	}); err != nil {
		return nil, fmt.Errorf("error fetching GCE managed instance group members for %q: %v", mig.Name, err)
	}

	if len(matches) == 0 {
		return nil, fmt.Errorf("instance %v not managed by mig %s", instanceID, mig.Name)
	}
	if len(matches) > 1 {
		// Should be impossible - shows that filters / post-filters are not working
		return nil, fmt.Errorf("found multiple instances with id %v managed by mig %s", instanceID, mig.Name)
	}

	return matches[0], nil
}

// lastComponent returns the last component of a URL, i.e. anything after the last slash
// If there is no slash, returns the whole string
func lastComponent(s string) string {
	lastSlash := strings.LastIndex(s, "/")
	if lastSlash != -1 {
		s = s[lastSlash+1:]
	}
	return s
}

func getMetadataValue(metadata *compute.Metadata, key string) string {
	value := ""
	if metadata != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Upgrade kops to the latest patch — this is treated as an internal invariant violation
Inspect the MIG members for duplicate entries via gcloud and file a GCE support case if duplicates are real
Retry; a transient bad API response usually does not reproduce
File a kops issue with the MIG name and instance ID if it persists

Defensive patterns

Strategy: try-catch

Type guard

func exactlyOne(matches []*compute.InstanceWithNamedPorts) (*compute.InstanceWithNamedPorts, bool) {
  if len(matches) == 1 { return matches[0], true }
  return nil, false
}

Try / catch

inst, err := getManagedInstance(mig, id)
if err != nil && strings.Contains(err.Error(), "found multiple instances") {
  // invariant violation: report to kops, retry once
}

Prevention

Keep kops up to date (this is an internal invariant error)
Monitor for GCE API anomalies via support channels
Log MIG name and instance ID for bug reports

When it happens

Trigger: len(matches) > 1 after post-filtering MIG ListInstances results by instance ID — e.g. the ID-based filter did not apply server-side and duplicate/unexpected entries came back, or corrupted/zero instance IDs bypassed the filter.

Common situations: GCE API behavioral change or bug returning duplicate member entries; upstream kops filter regression; extremely unusual project state (instance ID reuse after deletion, which GCE disallows).

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4ddc24bb7ee84b72. Report an issue: GitHub.