kubernetes/kops · error

found multiple VPCs matching tags

Error message

found multiple VPCs matching tags

What it means

After DescribeVpcs, VPC.Find expects exactly one match (either by ID or by kops name tag filters); if more than one VPC is returned it refuses to guess and returns this error. This protects against mutating the wrong VPC.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:92

	request := &ec2.DescribeVpcsInput{}

	if fi.ValueOf(e.ID) != "" {
		request.VpcIds = []string{aws.ToString(e.ID)}
	} else {
		request.Filters = cloud.BuildFilters(e.Name)
	}

	response, err := cloud.EC2().DescribeVpcs(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing VPCs: %v", err)
	}
	if response == nil || len(response.Vpcs) == 0 {
		return nil, nil
	}

	if len(response.Vpcs) != 1 {
		return nil, fmt.Errorf("found multiple VPCs matching tags")
	}
	vpc := response.Vpcs[0]
	actual := &VPC{
		ID:         vpc.VpcId,
		CIDR:       vpc.CidrBlock,
		AmazonIPv6: aws.Bool(false),
		Name:       findNameTag(vpc.Tags),
		Tags:       intersectTags(vpc.Tags, e.Tags),
	}

	klog.V(4).Infof("found matching VPC %v", actual)

	for _, association := range vpc.Ipv6CidrBlockAssociationSet {
		if association.Ipv6CidrBlockState == nil {
			continue
		}

		state := association.Ipv6CidrBlockState.State

View on GitHub (pinned to 4c8573c808)

Solutions

1. Find the duplicate VPCs (aws ec2 describe-vpcs --filters Name=tag:KubernetesCluster,Values=<name>) and delete the stale one
2. Use a unique cluster name per account/region going forward
3. If a VPC is intentionally shared, configure kOps to use the shared VPC (vpc id in the spec) rather than tag matching

// before apply, assert exactly one VPC carries the cluster tag
dupes := []string{}
out, _ := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{Filters: []types.Filter{{Name: aws.String("tag:KubernetesCluster"), Values: []string{clusterName}}}})
for _, v := range out.Vpcs { dupes = append(dupes, *v.VpcId) }
if len(dupes) > 1 { return fmt.Errorf("duplicate VPCs with cluster tag: %v", dupes) }

When it happens

Trigger: Multiple VPCs share the same kops tag (e.g. KubernetesCluster=<cluster>) — typically from a duplicated/re-created cluster with the same name in the same account/region, or a manual filter in the spec matching several VPCs.

Common situations: Recreating a cluster with the same name before the old VPC was deleted; running kOps against an account with leftover test clusters sharing the cluster name tag; reusing a cluster name across environments in one account.

Related errors

• error deleting Subnet %q: %v
• error listing subnets: %v
• error detaching InternetGateway %q: %v
• error associating VPC with hosted zone %q: %v
• VPC ID is required when EgressOnlyInternetGateway is shared

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e4af4429015455f5. Report an issue: GitHub.