{"record":{"id":"06443e157950b331","repo":"kubernetes/kops","slug":"error-creating-lb-listener-v","errorCode":null,"errorMessage":"error creating LB listener: %v","messagePattern":"error creating LB listener: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/lblistener.go","lineNumber":167,"sourceCode":"\t}\n\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating LB with Name: %q\", fi.ValueOf(e.Name))\n\t\tlisteneropts := listeners.CreateOpts{\n\t\t\tName:           fi.ValueOf(e.Name),\n\t\t\tDefaultPoolID:  fi.ValueOf(e.Pool.ID),\n\t\t\tLoadbalancerID: fi.ValueOf(e.Pool.Loadbalancer.ID),\n\t\t\tProtocol:       listeners.ProtocolTCP,\n\t\t\tProtocolPort:   fi.ValueOf(e.Port),\n\t\t}\n\n\t\tif useVIPACL && (fi.ValueOf(e.Pool.Loadbalancer.Provider) != \"ovn\") {\n\t\t\tlisteneropts.AllowedCIDRs = e.AllowedCIDRs\n\t\t}\n\n\t\tlistener, err := t.Cloud.CreateListener(listeneropts)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating LB listener: %v\", err)\n\t\t}\n\t\te.ID = new(listener.ID)\n\t\treturn nil\n\t} else if len(changes.AllowedCIDRs) > 0 {\n\t\tif useVIPACL && (fi.ValueOf(a.Pool.Loadbalancer.Provider) != \"ovn\") {\n\t\t\topts := listeners.UpdateOpts{\n\t\t\t\tAllowedCIDRs: &changes.AllowedCIDRs,\n\t\t\t}\n\t\t\t_, err := listeners.Update(context.TODO(), t.Cloud.LoadBalancerClient(), fi.ValueOf(a.ID), opts).Extract()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating LB listener: %v\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tklog.V(2).Infof(\"Openstack Octavia VIPACLs not supported\")\n\t\t}\n\t\treturn nil\n\t}\n\tklog.V(2).Infof(\"Openstack task LB::RenderOpenstack did nothing\")","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/lblistener.go#L149-L185","documentation":"kOps' LBListener RenderOpenstack task wraps any failure from the Octavia listener-create API (listeners.Create via t.Cloud.CreateListener). The wrapped error comes from the Openstack Octavia API (auth, quota, validation, port conflicts, etc.). It indicates the listener could not be created for the load balancer backing a Kubernetes API NLB.","triggerScenarios":"Rendering a new LBListener (a == nil) when the Octavia POST /v2/lbaas/listeners call fails: e.g. loadbalancer not in ACTIVE state, invalid protocol/port, listener quota exhausted, project quota exceeded, or transient 4xx/5xx from Octavia.","commonSituations":"Cluster create/update on OpenStack where the load balancer service quota (listeners per project) is exhausted; the LB is still PENDING_* from a prior operation; octavia provider (e.g. ovn) rejects TCP listener on the chosen port; stale/expired OpenStack credentials.","solutions":["Read the wrapped %v error: it contains the Octavia API status/body; fix the underlying cause (quota, state, validation).","Check project LB quotas: openstack quota show --load-balancer; raise listener quota if 'quota exceeded'.","Ensure the load balancer is ACTIVE (openstack loadbalancer show <lb-id>) before re-running kops; wait for pending operations to finish.","Verify octavia provider compatibility (ovn only supports certain listener configs); adjust cluster spec or wait/retry the kops update."],"exampleFix":"// before: listener created before LB ACTIVE\npool, err := t.Cloud.CreatePool(...) // LB still PENDING_ACTIVE\nlistener, err := t.Cloud.CreateListener(listeneropts)\n// after: wait for ACTIVE status first\nif err := waitLoadbalancerActiveProvisioningStatus(t.Cloud.LoadBalancerClient(), fi.ValueOf(e.Pool.Loadbalancer.ID)); err != nil {\n\treturn err\n}\nlistener, err := t.Cloud.CreateListener(listeneropts)","handlingStrategy":"retry","validationCode":"// before invoking kops update, ensure the Octavia LB is ACTIVE and quotas allow a new listener\nlb := openstackLoadbalancerShow(lbID)\nif lb.ProvisioningStatus != \"ACTIVE\" { return fmt.Errorf(\"LB %s is %s; wait before creating listener\", lbID, lb.ProvisioningStatus) }\nif listenersUsed >= listenerQuota { return fmt.Errorf(\"listener quota exhausted for project\") }","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n\tvar apiErr gophercloud.ErrUnexpectedResponseCode\n\tif errors.As(err, &apiErr) && apiErr.StatusCode == 409 {\n\t\t// LB not ACTIVE: back off and retry\n\t\ttime.Sleep(30 * time.Second); retry()\n\t}\n\treturn fmt.Errorf(\"listener creation failed: %w\", err)\n}","preventionTips":["Monitor project Octavia quotas (listeners, pools) before scaling clusters.","Serialize LB mutations so the LB is always ACTIVE before dependent tasks run.","Validate admin-access CIDRs and provider compatibility (ovn) in the cluster spec ahead of time."],"tags":["openstack","octavia","loadbalancer","api-error"],"backgroundTag":"octavia-listener-create-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}