kubernetes/kops · error

found multiple tags for: %v

Error message

found multiple tags for: %v

What it means

findNatGateway looks up a NAT gateway by the subnet's kOps 'AssociatedNatgateway' tag, whose value is the gateway ID. If the DescribeTags API returns more than one tag record for the tag key/filter combination, the code cannot unambiguously pick a value, so it fails rather than guessing.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/natgateway.go:173

			return nil, nil
		}
		filters = append(filters, awsup.NewEC2Filter("resource-id", *e.Subnet.ID))

		request := &ec2.DescribeTagsInput{
			Filters: filters,
		}

		response, err := cloud.EC2().DescribeTags(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing tags: %v", err)
		}

		if response == nil || len(response.Tags) == 0 {
			return nil, nil
		}

		if len(response.Tags) != 1 {
			return nil, fmt.Errorf("found multiple tags for: %v", e)
		}
		t := response.Tags[0]
		id = t.Value
		klog.V(2).Infof("Found NatGateway via subnet tag: %v", *id)
	}

	if id != nil {
		return findNatGatewayById(ctx, cloud, fi.ValueOf(id))
	}

	return nil, nil
}

func findNatGatewayById(ctx context.Context, cloud awsup.AWSCloud, id string) (*ec2types.NatGateway, error) {
	request := &ec2.DescribeNatGatewaysInput{}
	request.NatGatewayIds = []string{id}
	response, err := cloud.EC2().DescribeNatGateways(ctx, request)
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Describe the subnet's tags in the AWS console/CLI and delete the duplicate AssociatedNatgateway tag entry so exactly one remains
2. Use `aws ec2 describe-tags --filters Name=resource-id,Values=<subnet-id>` to identify which resource each duplicate tag belongs to and remove the stale one
3. Re-run `kops update cluster` after cleanup so Find succeeds and the state is reconciled

Example fix

// before (duplicate tag on subnet)
aws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-111
aws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-222
// after (single authoritative tag)
aws ec2 delete-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway
aws ec2 create-tags --resources subnet-0abc --tags Key=kops.k8s.io/AssociatedNatgateway,Value=nat-111

out, err := aws ec2 describe-tags via SDK; count := len(out.Tags)
if count != 1 { // fix tags before running kops
  fmt.Printf("expected 1 AssociatedNatgateway tag, found %d\n", count)
}

func singleTag(tags []ec2types.Tag) *ec2types.Tag {
  if len(tags) == 1 { return &tags[0] }
  return nil
}

gw, err := findNatGateway(ctx, cloud, subnet)
if err != nil && strings.Contains(err.Error(), "found multiple tags for") {
  // prompt operator to dedupe the subnet's AssociatedNatgateway tag, then retry
}

When it happens

Trigger: DescribeTags response for the subnet contains len(Tags) != 1 (typically 2+) — e.g. duplicate tag rows on the subnet matching the AssociatedNatgateway tag key, or a filter that matches both the subnet tag and another resource's tag.

Common situations: Clusters where tags were applied twice by retrying provisioning or a manual tag-copy script; hand-edited AWS tags; older clusters migrated between kOps versions that changed tag conventions leaving stale duplicates.

Related errors

• Could not find '%s' tag from route table
• unable to tag NatGateway
• found multiple Volumes with name: %s
• error adding AWS Tags to EBS Volume: %v
• found multiple EgressOnlyInternetGateways matching tags

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e4af6e3d7d8a3693. Report an issue: GitHub.