kubernetes/kops · error

unexpected number of access configs in template %q: %d

Error message

unexpected number of access configs in template %q: %d

What it means

When reading back a matching instance template, kOps only models zero or one access config per network interface (absence = no external IP; exactly one ONE_TO_ONE_NAT = external IP). If the discovered template has more than one access config on its first network interface, the state can't be represented, so Find aborts with this error naming the template and count.

Source

Thrown at upup/pkg/fi/cloudup/gcetasks/instancetemplate.go:170

			if ni.StackType != "" {
				actual.StackType = &ni.StackType
			}

			if len(ni.AliasIpRanges) != 0 {
				actual.AliasIPRanges = make(map[string]string)
				for _, aliasIPRange := range ni.AliasIpRanges {
					actual.AliasIPRanges[aliasIPRange.SubnetworkRangeName] = aliasIPRange.IpCidrRange
				}
			}

			if ni.Subnetwork != "" {
				actual.Subnet = &Subnet{Name: new(lastComponent(ni.Subnetwork))}
			}

			acs := ni.AccessConfigs
			if len(acs) > 0 {
				if len(acs) != 1 {
					return nil, fmt.Errorf("unexpected number of access configs in template %q: %d", *actual.Name, len(acs))
				}
				if acs[0].Type != accessConfigOneToOneNAT {
					return nil, fmt.Errorf("unexpected access type in template %q: %s", *actual.Name, acs[0].Type)
				}
				actual.HasExternalIP = new(true)
			} else {
				actual.HasExternalIP = new(false)
			}
		}

		for _, serviceAccount := range p.ServiceAccounts {
			for _, scope := range serviceAccount.Scopes {
				actual.Scopes = append(actual.Scopes, scopeToShortForm(scope))
			}
			actual.ServiceAccounts = append(actual.ServiceAccounts, &ServiceAccount{
				Email: &serviceAccount.Email,
			})
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Identify the template (name is printed in the error) and inspect it: `gcloud compute instance-templates describe <name>`
2. Remove the extra access configs so the first network interface has at most one ONE_TO_ONE_NAT config
3. Recreate the template through kOps so its network config matches the cluster spec
4. If the template isn't managed by kOps, rename or delete it so it no longer matches the NamePrefix

Example fix

// before: two access configs on ni[0]
// after: keep exactly one
# recreate template via kops, or:
gcloud compute instance-templates create <name> ... --network-interface=...,access-config=  # single access config only

# Assert no managed template has more than one access config:
for t in $(gcloud compute instance-templates list --format="value(name)" | grep '^<nameprefix>-'); do
  n=$(gcloud compute instance-templates describe $t --format="value(properties.networkInterfaces[0].accessConfigs.len())")
  [ "$n" -le 1 ] || echo "FAIL: $t has $n access configs"
done

When it happens

Trigger: An instance template matching the task's NamePrefix was created or edited out-of-band with multiple access configs on network interface 0 (e.g. multiple external IPs, or both IPv4 and IPv6 ephemeral access configs added manually).

Common situations: Manual gcloud/console edits adding a second external IP; templates generated by other automation attaching several NAT configs; dual-stack experimentation adding an extra access config alongside the existing one.

Related errors

• unexpected access type in template %q: %s
• instance %s did not have Version set
• ig name not set on instance template %s
• error deleting InstanceTemplate %s: %w
• error updating InstanceTemplate for InstanceGroupManager: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/028b01d64ddb4f84. Report an issue: GitHub.