kubernetes/kops · error

found multiple SecurityGroups matching tags

Error message

found multiple SecurityGroups matching tags

What it means

findEc2 located more than one EC2 SecurityGroup matching the name/tag filters within the VPC; kOps expects a unique match for idempotent lookups and refuses to pick between them.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:130

		filters = append(filters, awsup.NewEC2Filter("vpc-id", *e.VPC.ID))
		filters = append(filters, awsup.NewEC2Filter("group-name", *e.Name))
		request.Filters = filters

	} else {
		// No reason to try.
		return nil, nil
	}

	response, err := cloud.EC2().DescribeSecurityGroups(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing SecurityGroups: %v", err)
	}
	if response == nil || len(response.SecurityGroups) == 0 {
		return nil, nil
	}

	if len(response.SecurityGroups) != 1 {
		return nil, fmt.Errorf("found multiple SecurityGroups matching tags")
	}
	sg := response.SecurityGroups[0]
	return &sg, nil
}

func (e *SecurityGroup) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (_ *SecurityGroup) ShouldCreate(a, e, changes *SecurityGroup) (bool, error) {
	if fi.ValueOf(e.Shared) {
		return false, nil
	}
	return true, nil
}

func (_ *SecurityGroup) CheckChanges(a, e, changes *SecurityGroup) error {
	if a != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. List SGs with the duplicated tags: aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned
2. Delete or re-tag the extraneous duplicate security group
3. Keep kOps tag names unique per cluster; avoid cloning kops-managed SGs
4. Re-run kops update to confirm reconciliation succeeds

Example fix

aws ec2 delete-security-group --group-id <duplicate-sg-id>

aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned --query 'length(SecurityGroups)' # expect 1 per role

When it happens

Trigger: DescribeSecurityGroups with the task's tag filters returns 2+ security groups during Find/FindDeletions — duplicate groups sharing kOps's tag key/value (e.g., same Name tag like 'nodes.cluster.example.com').

Common situations: Security groups manually copied/cloned in the console retaining kOps tags; failed previous apply left a duplicate before tags were fixed; importing an existing cluster where SGs were duplicated; shared VPC where another team's SG has identical tags.

Related errors

• provider ID cannot be empty
• error building cloud tags: %v
• error building cloud tags: %v
• error listing elb Tags: %v
• error describing SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b43e4e7d1ab12391. Report an issue: GitHub.