kubernetes/kops · error

NLB has more then one PrivateIPv4Address, which is unexpecte

Error message

NLB has more then one PrivateIPv4Address, which is unexpected. This is a bug in kOps, please open a GitHub issue.

What it means

While rebuilding NLB state in Find, kOps maps each availability zone to one SubnetMapping and expects at most one PrivateIPv4Address per subnet. If DescribeLoadBalancers returns multiple addresses with a private IPv4 for a single AZ, it reports this as a kOps bug and asks for a GitHub issue.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/network_load_balancer.go:232

	for _, tag := range latest.Tags {
		k := aws.ToString(tag.Key)
		if strings.HasPrefix(k, "aws:cloudformation:") {
			continue
		}
		if k == awsup.KopsResourceRevisionTag {
			continue
		}
		actual.Tags[k] = aws.ToString(tag.Value)
	}

	for _, az := range lb.AvailabilityZones {
		sm := &SubnetMapping{
			Subnet: &Subnet{ID: az.SubnetId},
		}
		for _, a := range az.LoadBalancerAddresses {
			if a.PrivateIPv4Address != nil {
				if sm.PrivateIPv4Address != nil {
					return nil, fmt.Errorf("NLB has more then one PrivateIPv4Address, which is unexpected. This is a bug in kOps, please open a GitHub issue.")
				}
				sm.PrivateIPv4Address = a.PrivateIPv4Address
			}
			if a.AllocationId != nil {
				if sm.AllocationID != nil {
					return nil, fmt.Errorf("NLB has more then one AllocationID per subnet, which is unexpected. This is a bug in kOps, please open a GitHub issue.")
				}
				sm.AllocationID = a.AllocationId
			}
		}
		actual.SubnetMappings = append(actual.SubnetMappings, sm)
	}

	for _, sg := range lb.SecurityGroups {
		actual.SecurityGroups = append(actual.SecurityGroups, &SecurityGroup{ID: aws.String(sg)})
	}

	{

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the NLB's per-AZ addresses with aws elbv2 describe-load-balancers; remove unexpected manual changes
2. Confirm the discovered NLB actually belongs to this cluster (check tags/name)
3. If the API genuinely returned multiple private IPs for one subnet, file a GitHub issue with kops version and the NLB description output as the message instructs

// verify NLB address shape before letting kops adopt it
for _, az := range lb.AvailabilityZones {
    n := 0
    for _, a := range az.LoadBalancerAddresses { if a.PrivateIPv4Address != nil { n++ } }
    if n > 1 { return fmt.Errorf("NLB az %s has %d private IPs; fix externally first", aws.ToString(az.SubnetId), n) }
}

func atMostOnePrivateIP(az elbv2types.AvailabilityZone) bool {
    n := 0
    for _, a := range az.LoadBalancerAddresses { if a.PrivateIPv4Address != nil { n++ } }
    return n <= 1
}

When it happens

Trigger: An AZ's LoadBalancerAddresses contains two or more entries with non-nil PrivateIPv4Address during Find on an internal NLB with statically assigned private IPs.

Common situations: NLB modified outside kOps (manually added second address); AWS behavior change or unexpected API response shape; wrong load balancer discovered matching the cluster's name/tag.

Related errors

• found multiple instances with instance id: %s
• found multiple InternetGateways with id %q
• error deleting V2 LoadBalancer %q: %v
• found multiple SecurityGroups with ID %q
• error mapping DNSName %q to LoadBalancer: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/67346c38a86e2055. Report an issue: GitHub.