What causes "Unexpected desired subnets for `%s`. Expected 1, got %d" in kubernetes/kops?

Run `openstack subnet list --name ` with the same credentials/project kOps uses and confirm exactly one row matches

Unexpected desired subnets for `%s`. Expected 1, got %d

Error message

Unexpected desired subnets for `%s`.  Expected 1, got %d

What it means

kOps looks up the OpenStack Neutron subnet by name (e.Subnet) when creating an Octavia load balancer and requires the name to resolve to exactly one subnet. This error is thrown when zero subnets or more than one subnet match that name, since kOps cannot pick a VIP subnet deterministically.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/lb.go:205

		if changes.Name != nil {
			return fi.CannotChangeField("Name")
		}
	}
	return nil
}

func (_ *LB) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *LB) error {
	if a == nil {
		klog.V(2).Infof("Creating LB with Name: %q", fi.ValueOf(e.Name))

		subnets, err := t.Cloud.ListSubnets(subnets.ListOpts{
			Name: fi.ValueOf(e.Subnet),
		})
		if err != nil {
			return fmt.Errorf("Failed to retrieve subnet `%s` in loadbalancer creation: %v", fi.ValueOf(e.Subnet), err)
		}
		if len(subnets) != 1 {
			return fmt.Errorf("Unexpected desired subnets for `%s`.  Expected 1, got %d", fi.ValueOf(e.Subnet), len(subnets))
		}

		lbopts := loadbalancers.CreateOpts{
			Name:        fi.ValueOf(e.Name),
			VipSubnetID: subnets[0].ID,
		}
		if e.FlavorID != nil {
			lbopts.FlavorID = fi.ValueOf(e.FlavorID)
		}
		lb, err := t.Cloud.CreateLB(lbopts)
		if err != nil {
			return fmt.Errorf("error creating LB: %v", err)
		}
		e.ID = new(lb.ID)
		e.PortID = new(lb.VipPortID)
		e.VipSubnet = new(lb.VipSubnetID)
		e.Provider = new(lb.Provider)
		e.FlavorID = new(lb.FlavorID)

View on GitHub (pinned to 4c8573c808)

Solutions

Run `openstack subnet list --name <name>` with the same credentials/project kOps uses and confirm exactly one row matches
Correct the subnet name in the kops cluster spec (or delete/rename duplicate subnets so the name is unique)
Verify the OS_* environment variables / cloud config point at the correct project; use subnet ID semantics or unique names

Example fix

// before (duplicate subnet names in two networks)
openstack subnet create --network net-a --subnet-range 10.0.0.0/24 nodes
openstack subnet create --network net-b --subnet-range 10.0.1.0/24 nodes
// after: rename so the kops-configured name is unique
openstack subnet set net-b-nodes-subnet --name nodes-net-b
// kops spec references unique name 'nodes' which now matches exactly one

Defensive patterns

Strategy: validation

Validate before calling

// Before running kops update cluster
subnets=$(openstack subnet list --name nodes-subnet -f value -c ID)
count=$(echo "$subnets" | grep -c . || true)
[ "$count" -eq 1 ] || { echo "expected exactly 1 subnet named nodes-subnet, got $count"; exit 1; }

Prevention

Use globally unique subnet names in your OpenStack project before wiring them into the kops cluster spec
Verify with `openstack subnet list` that the name matches exactly one subnet under the same OS_* credentials kOps uses
Prefer referencing subnets via a single network with deterministic naming in Heat/Terraform

When it happens

Trigger: `kops update cluster` on an OpenStack cluster where the subnet name in the cluster config does not match any subnet in the tenant (0 matches), or matches multiple subnets because the same name exists in several networks/projects or regions (2+ matches).

Common situations: Typo or case mismatch in the cluster spec's subnet name; subnet created in a different project than the credentials used; subnet renamed or deleted after cluster creation; multiple networks created by automation with duplicate subnet names.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/2b7f42d4d42da138. Report an issue: GitHub.