kubernetes/kops · error

found multiple listeners matching %+v

Error message

found multiple listeners matching %+v

What it means

After matching found listeners against the task's desired port/protocol, Find returns this error when more than one listener matches. kOps requires a one-to-one mapping between the NetworkLoadBalancerListener task and an actual AWS listener to compute actual state; ambiguity is treated as a hard error.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/networkloadbalancerlistener.go:97

		for paginator.HasMorePages() {
			page, err := paginator.NextPage(ctx)
			if err != nil {
				return nil, fmt.Errorf("error querying for NLB listeners :%v", err)
			}
			allListeners = append(allListeners, page.Listeners...)
		}

		var matches []elbv2types.Listener
		for _, listener := range allListeners {
			if aws.ToInt32(listener.Port) == int32(e.Port) {
				matches = append(matches, listener)
			}
		}
		if len(matches) == 0 {
			return nil, nil
		}
		if len(matches) > 1 {
			return nil, fmt.Errorf("found multiple listeners matching %+v", e)
		}
		l = &matches[0]
	}

	actual := &NetworkLoadBalancerListener{}
	actual.listenerArn = aws.ToString(l.ListenerArn)

	actual.Port = int(aws.ToInt32(l.Port))
	if len(l.Certificates) != 0 {
		actual.SSLCertificateID = aws.ToString(l.Certificates[0].CertificateArn) // What if there is more then one certificate, can we just grab the default certificate? we don't set it as default, we only set the one.
		if l.SslPolicy != nil {
			actual.SSLPolicy = aws.ToString(l.SslPolicy)
		}
	}

	// This will need to be rearranged when we recognized multiple listeners and target groups per NLB
	if len(l.DefaultActions) > 0 {
		targetGroupARN := l.DefaultActions[0].TargetGroupArn

View on GitHub (pinned to 4c8573c808)

Solutions

1. List listeners on the NLB (aws elbv2 describe-listeners --load-balancer-arn <arn>) and delete the duplicate for the affected port
2. Keep exactly one listener per port for kOps-managed NLBs
3. Re-run kops update cluster after cleanup
4. If intentional multiple listeners per port are needed (e.g. different TLS policies), model them as separate tasks with distinct match criteria

Example fix

// before: duplicate listeners on port 443
// listener-1 :443 TLS, listener-2 :443 TLS (manual)
// after: remove the manual duplicate
aws elbv2 delete-listener --listener-arn listener-2

// detect duplicates before apply
seen := map[string]bool{}
for _, l := range allListeners {
  key := fmt.Sprintf("%d/%s", l.Port, l.Protocol)
  if seen[key] { return fmt.Errorf("duplicate listener for %s", key) }
  seen[key] = true
}

if len(matches) > 1 {
  return nil, fmt.Errorf("found multiple listeners matching %+v", e)
}
// remediate by deleting the duplicate manually, then re-run apply

When it happens

Trigger: Two or more listeners on the same NLB share the same port (and protocol) the task matches on — e.g. duplicate listeners created manually or by a previous buggy apply.

Common situations: Manual listener creation in the AWS console duplicating a kOps-managed port; leftover listeners from a prior cluster apply; kOps spec changes that remap ports leaving orphans.

Related errors

• error querying for NLB listeners :%v
• load balancer not yet created (arn not set)
• error deleting load balancer listener with arn=%q: %w
• target group not yet created (arn not set)
• error deleting V2 LoadBalancer %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3987b74b67f45a34. Report an issue: GitHub.