kubernetes/kops · error

spotinst: found multiple role tags %q vs %q

Error message

spotinst: found multiple role tags %q vs %q

What it means

While rendering Terraform for a Spotinst Ocean, kOps scans the task's tags for `kops.k8s.io/instance_group_role` role tags and expects at most one distinct role suffix. If two tags map to different roles (e.g. both a master and a node role tag), it cannot decide which role the Ocean represents and throws this error.

Source

Thrown at upup/pkg/fi/cloudup/spotinsttasks/ocean.go:1216

	// Image.
	if e.ImageID != nil {
		image, err := resolveImage(cloud, fi.ValueOf(e.ImageID))
		if err != nil {
			return err
		}
		tf.ImageID = image.ImageId
	}

	var role string
	for key := range e.Tags {
		if strings.HasPrefix(key, awstasks.CloudTagInstanceGroupRolePrefix) {
			suffix := strings.TrimPrefix(key, awstasks.CloudTagInstanceGroupRolePrefix)
			if role == "master" {
				role = "control-plane"
			}
			if role != "" && role != suffix {
				return fmt.Errorf("spotinst: found multiple role tags %q vs %q", role, suffix)
			}
			role = suffix
		}
	}

	// Security groups.
	if e.SecurityGroups != nil {
		for _, sg := range e.SecurityGroups {
			tf.SecurityGroups = append(tf.SecurityGroups, sg.TerraformLink())
			if role != "" {
				if err := t.AddOutputVariableArray(role+"_security_groups", sg.TerraformLink()); err != nil {
					return err
				}
			}
		}
	}

	// Monitoring.

View on GitHub (pinned to 4c8573c808)

Solutions

1. Edit the cluster spec and remove the duplicate/conflicting `kops.k8s.io/instance_group_role*` tag so only one role remains per Ocean.
2. Re-run `kops update cluster` after `kops replace -f cluster.yaml` to regenerate Terraform with a single role tag.
3. If roles were merged intentionally, split the resources so each Ocean/instance group has its own role tag.

Example fix

// before (cluster spec tags)
kops.k8s.io/instance_group_role_master: ""
kops.k8s.io/instance_group_role_node: ""
// after
kops.k8s.io/instance_group_role_node: ""

// ensure only one distinct role tag is present
roles := map[string]bool{}
for k := range tags {
    if strings.HasPrefix(k, awstasks.CloudTagInstanceGroupRolePrefix) {
        roles[strings.TrimPrefix(k, awstasks.CloudTagInstanceGroupRolePrefix)] = true
    }
}
if len(roles) > 1 { return fmt.Errorf("multiple role tags: %v", roles) }

When it happens

Trigger: The cluster spec's tags on the Spotinst task carry the CloudTagInstanceGroupRolePrefix prefix with more than one distinct suffix (e.g. 'master' and 'node'), typically from copy-pasting tags between instance groups or merging cluster specs.

Common situations: Hand-edited cluster.yaml where role tags from multiple instance groups were combined onto one resource; automated tooling injecting extra `kops.k8s.io/instance_group_role*` tags.

Related errors

• spotinst: found multiple role tags %q vs %q
• error building cloud tags: %v
• parsing StorageAccountID: %w
• spotinst: found multiple role tags %q vs %q
• provider ID cannot be empty

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/23508ef85591c866. Report an issue: GitHub.