kubernetes/kops · error

we currently do not support multiple Etcd IPs

Error message

we currently do not support multiple Etcd IPs

What it means

For API-server groups, well-known EtcdMain addresses are baked into bootConfig.EtcdIPs (e.g. for /etc/hosts). The code supports at most one Etcd IP; if more than one address is registered for EtcdMain, this error aborts config build.

Source

Thrown at pkg/nodemodel/nodeupconfigbuilder.go:317

	// Bake control-plane IPs into /etc/hosts (for api.internal and kops-controller.internal):
	//   - non-CP roles in any cluster that exposes kops-controller on the API LB,
	//   - any role on clouds without DNS-based kops-controller discovery.
	// CP nodes get api.internal=127.0.0.1 from etc_hosts.go's IsMaster branch and don't
	// connect to kops-controller.internal externally, so they don't need APIServerIPs.
	if cluster.UsesLoadBalancerForKopsController() && !ig.RunsAPIServer() {
		bootConfig.APIServerIPs = controlPlaneIPs
	} else {
		switch cluster.GetCloudProvider() {
		case kops.CloudProviderHetzner, kops.CloudProviderScaleway, kops.CloudProviderDO, kops.CloudProviderMetal:
			bootConfig.APIServerIPs = controlPlaneIPs
		}
	}

	// Bake Etcd LB IPs into /etc/hosts if etcd is not local and there is an API Server.
	if role.HasAPIServer() {
		if len(wellKnownAddresses[wellknownservices.EtcdMain]) > 0 {
			if len(wellKnownAddresses[wellknownservices.EtcdMain]) > 1 {
				return nil, nil, fmt.Errorf("we currently do not support multiple Etcd IPs")
			}
			bootConfig.EtcdIPs = wellKnownAddresses[wellknownservices.EtcdMain]
		}
	}

	useConfigServer := !ig.RunsAPIServer()
	if useConfigServer {
		bootConfig.ConfigServer = buildConfigServerOptions(cluster.ObjectMeta.Name, config.CAs[fi.CertificateIDCA], bootConfig.APIServerIPs)
		delete(config.CAs, fi.CertificateIDCA)
	} else {
		bootConfig.ConfigBase = new(n.configBase.Path())
	}

	for _, manifest := range n.assetBuilder.StaticManifests() {
		if !manifest.AppliesToRole(role) {
			continue
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Upgrade kOps/nodeup to a version supporting multiple etcd IPs (this limitation was lifted in later versions)
2. Ensure only one address is registered for wellKnownServices.EtcdMain (fix etcd registration or use a single LB IP)
3. Reduce the etcd main cluster topology exposed to API-server nodes or adjust wellKnownAddresses construction

Example fix

// before
addresses[wellknownservices.EtcdMain] = []string{"10.0.0.1", "10.0.0.2"}
// after
addresses[wellknownservices.EtcdMain] = []string{"10.0.0.1"} // single IP, or upgrade kOps

if len(addresses[wellknownservices.EtcdMain]) > 1 {
    return fmt.Errorf("pre-check failed: %d EtcdMain addresses; max 1 supported", len(addresses[wellknownservices.EtcdMain]))
}

When it happens

Trigger: BuildConfig with role.HasAPIServer() and wellKnownAddresses[EtcdMain] containing 2+ entries — e.g. clusters where etcd main is fronted by multiple registered IPs, or address registration bug adding duplicates.

Common situations: Multi-member etcd clusters registering all member IPs as well-known addresses; misconfigured etcd cluster with load balancer IPs; kOps version too old for the cluster topology (newer topologies removed this limitation).

Related errors

• error parsing path for etcd manifest %s: %v
• error reading etcd manifest %s: %v
• building nodeConfig for instanceGroup: %w
• marshalling nodeupConfig: %w
• issuing certificate: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b4388261d32f4b12. Report an issue: GitHub.