kubernetes/kops · error

spotinst: found multiple role tags %q vs %q

Error message

spotinst: found multiple role tags %q vs %q

What it means

While rendering Terraform for a LaunchSpec, kops scans instance-group role tags (CloudTagInstanceGroupRolePrefix). If the tags imply two different roles for the same resource, rendering aborts. This catches contradictory tagging such as one tag naming control-plane and another naming a node role.

Source

Thrown at upup/pkg/fi/cloudup/spotinsttasks/launch_spec.go:989

	{
		if e.ImageID != nil {
			image, err := resolveImage(cloud, fi.ValueOf(e.ImageID))
			if err != nil {
				return err
			}
			tf.ImageID = image.ImageId
		}
	}

	var role string
	for key := range e.Ocean.Tags {
		if strings.HasPrefix(key, awstasks.CloudTagInstanceGroupRolePrefix) {
			suffix := strings.TrimPrefix(key, awstasks.CloudTagInstanceGroupRolePrefix)
			if role == "master" {
				role = "control-plane"
			}
			if role != "" && role != suffix {
				return fmt.Errorf("spotinst: found multiple role tags %q vs %q", role, suffix)
			}
			role = suffix
		}
	}

	// Security groups.
	{
		if e.SecurityGroups != nil {
			for _, sg := range e.SecurityGroups {
				tf.SecurityGroups = append(tf.SecurityGroups, sg.TerraformLink())
				if role != "" {
					if err := t.AddOutputVariableArray(role+"_security_groups", sg.TerraformLink()); err != nil {
						return err
					}
				}
			}
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the instance group's extraTags and remove the stale/conflicting kops-role tag
2. Keep exactly one kops-role tag per instance group
3. If renaming roles, delete the old tag in the cluster spec and re-run kops update cluster

Example fix

// before (cluster spec instanceGroup extraTags)
"kops.k8s.io/instancegroup-role": "node", "kops-role": "control-plane"
// after
"kops.k8s.io/instancegroup-role": "node"

roles := map[string]bool{}
for k := range ig.Spec.ExtraTags {
    if strings.HasPrefix(k, "kops.k8s.io/instancegroup-role") {
        suffix := strings.TrimPrefix(k, "kops.k8s.io/instancegroup-role")
        roles[suffix] = true
    }
}
if len(roles) > 1 {
    return fmt.Errorf("conflicting role tags: %v", roles)
}

When it happens

Trigger: RenderTerraform encounters multiple tags with the awstasks.CloudTagInstanceGroupRolePrefix whose suffixes disagree, e.g. kops-role=master plus kops-role=node on the same security-group/IAM scope.

Common situations: Hand-added role tags on the instance group; leftover tags from a renamed group (old role tag not removed); migrating master->control-plane naming while keeping the old tag.

Related errors

• spotinst: found multiple role tags %q vs %q
• spotinst: found multiple role tags %q vs %q
• error building cloud tags: %v
• provider ID cannot be empty
• reconcile is not supported with terraform

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/57dc14107d65d89e. Report an issue: GitHub.