{"record":{"id":"1418ce90754d288a","repo":"kubernetes/kops","slug":"error-updating-port-v","errorCode":null,"errorMessage":"error updating port: %v","messagePattern":"error updating port: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/port.go","lineNumber":292,"sourceCode":"\t\treturn nil\n\t}\n\tif changes != nil {\n\t\tif changes.Tags != nil {\n\t\t\tklog.V(2).Infof(\"Updating tags for Port with name: %q\", fi.ValueOf(e.Name))\n\t\t\tfor _, tag := range e.Tags {\n\t\t\t\terr := t.Cloud.AppendTag(openstack.ResourceTypePort, fi.ValueOf(a.ID), tag)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"Error appending tag to port: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif changes.AllowedAddressPairs != nil {\n\t\t\tklog.V(2).Infof(\"Updating allowed address pairs for Port with name: %q\", fi.ValueOf(e.Name))\n\t\t\t_, err := t.Cloud.UpdatePort(fi.ValueOf(a.ID), ports.UpdateOpts{\n\t\t\t\tAllowedAddressPairs: &e.AllowedAddressPairs,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating port: %v\", err)\n\t\t\t}\n\t\t}\n\t}\n\te.ID = a.ID\n\tklog.V(2).Infof(\"Using an existing Openstack port, id=%s\", fi.ValueOf(e.ID))\n\treturn nil\n}\n\nfunc portCreateOptsFromPortTask(t *openstack.OpenstackAPITarget, a, e, changes *Port) (ports.CreateOptsBuilder, error) {\n\tsgs := make([]string, len(e.SecurityGroups)+len(e.AdditionalSecurityGroups))\n\tfor i, sg := range e.SecurityGroups {\n\t\tsgs[i] = fi.ValueOf(sg.ID)\n\t}\n\tfor i, sg := range e.AdditionalSecurityGroups {\n\t\topt := secgroup.ListOpts{\n\t\t\tName: sg,\n\t\t}\n\t\tgs, err := t.Cloud.ListSecurityGroups(opt)","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/port.go#L274-L310","documentation":"When changes.AllowedAddressPairs is non-nil, RenderOpenstack updates the port via t.Cloud.UpdatePort with ports.UpdateOpts{AllowedAddressPairs}. A failure from that Neutron port-update call is wrapped as 'error updating port'.","triggerScenarios":"Existing port with allowed-address-pair changes: UpdatePort(a.ID, ports.UpdateOpts{AllowedAddressPairs}) returns an error from Neutron (validation of pairs, port deleted, permissions).","commonSituations":"Allowed address pairs rejected by Neutron policy (e.g. anti-spoofing rules disallow the CIDR); port removed externally between Find and Render; API outage.","solutions":["Read the wrapped Neutron error for validation details","Verify allowed address pairs are permitted by the cloud's port security policy","Confirm the port still exists and its ID is valid","Re-run kops to retry the update"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"for _, p := range port.AllowedAddressPairs {\n    if !policyAllowsAddressPair(p.IPAddress) {\n        return fmt.Errorf(\"address pair %s likely rejected by neutron port-security policy\", p.IPAddress)\n    }\n}","typeGuard":null,"tryCatchPattern":"_, err := t.Cloud.UpdatePort(fi.ValueOf(a.ID), ports.UpdateOpts{AllowedAddressPairs: &e.AllowedAddressPairs})\nif err != nil {\n    return fmt.Errorf(\"error updating port: %v\", err) // inspect inner Neutron validation error\n}","preventionTips":["Check cloud anti-spoofing policy before setting allowed address pairs","Verify the port ID still exists before updating","Re-run apply on transient failures"],"tags":["openstack","neutron","port"],"backgroundTag":"openstack-api-update-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}