{"record":{"id":"1791016014519b41","repo":"kubernetes/kops","slug":"error-revoking-securitygroup-v","errorCode":null,"errorMessage":"error revoking SecurityGroup: %v","messagePattern":"error revoking SecurityGroup: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/securitygroup.go","lineNumber":248,"sourceCode":"\treturn true\n}\n\ntype deleteSecurityGroup struct {\n\tsecurityGroup *SecurityGroup\n}\n\nvar _ fi.CloudupDeletion = (*deleteSecurityGroup)(nil)\n\nfunc (d *deleteSecurityGroup) Delete(t fi.CloudupTarget) error {\n\tklog.V(2).Infof(\"deleting security group: %v\", fi.DebugAsJsonString(d.securityGroup.Name))\n\n\tos, ok := t.(*openstack.OpenstackAPITarget)\n\tif !ok {\n\t\treturn fmt.Errorf(\"unexpected target type for deletion: %T\", t)\n\t}\n\terr := os.Cloud.DeleteSecurityGroup(fi.ValueOf(d.securityGroup.ID))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error revoking SecurityGroup: %v\", err)\n\t}\n\treturn nil\n}\n\nfunc (d *deleteSecurityGroup) TaskName() string {\n\treturn \"SecurityGroup\"\n}\n\nfunc (d *deleteSecurityGroup) Item() string {\n\ts := fmt.Sprintf(\"securitygroup=%s\", fi.ValueOf(d.securityGroup.Name))\n\treturn s\n}\n\nfunc (d *deleteSecurityGroup) DeferDeletion() bool {\n\treturn false // TODO: Should we defer deletion?\n}\n\ntype deleteSecurityGroupRule struct {","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/securitygroup.go#L230-L266","documentation":"After the target type is confirmed as *openstack.OpenstackAPITarget, deleteSecurityGroup.Delete calls Cloud.DeleteSecurityGroup(id) to remove the security group via Neutron; this error wraps any failure of that DELETE /security_groups/{id} call. Common wrapped causes are 404 (group already gone), 409 conflict (group still attached to ports/interfaces), and auth/network failures.","triggerScenarios":"FindDeletions created a deleteSecurityGroup removal (RemoveGroup=true) and the subsequent Delete() call to Neutron fails — most often a 409 because instances/ports still reference the group, a 404 because it was deleted concurrently, or a 401 from expired credentials.","commonSituations":"Trying to tear down a security group while VMs/ports using it still exist; concurrent kops applies or manual `openstack security group delete`; OpenStack project quota/auth issues during cluster deletion.","solutions":["Read the wrapped '%v' detail: 409 means the group is still in use — delete or detach the ports/instances referencing it first.","If 404, the group is already gone; re-run kops delete/update so FindDeletions no longer sees it.","Verify credentials and Neutron reachability (openstack token issue) and retry.","Ensure all instances and load balancers in the cluster are deleted before deleting the security group."],"exampleFix":"// before: fails with conflict\nkops delete cluster --name mycluster --yes\n// error revoking SecurityGroup: Conflict: security group is in use by port X\n// after: delete dependent resources first\nopenstack port list --security-group <sg-id>\nkops delete cluster --name mycluster --yes","handlingStrategy":"retry","validationCode":"// before deleting, ensure no ports still reference the group\npage, _ := ports.List(neutron, ports.ListOpts{SecurityGroupID: sgID}).AllPages()\nplist, _ := ports.ExtractPorts(page)\nif len(plist) > 0 { // group still in use; detach or delete dependent resources first\n}","typeGuard":"func isNotFound(err error) bool { return strings.Contains(err.Error(), \"404\") || strings.Contains(err.Error(), \"not found\") }\nfunc isInUse(err error) bool { return strings.Contains(err.Error(), \"409\") || strings.Contains(err.Error(), \"in use\") }","tryCatchPattern":"err := os.Cloud.DeleteSecurityGroup(fi.ValueOf(d.securityGroup.ID))\nif err != nil {\n\tif isNotFound(err) {\n\t\treturn nil // already deleted; treat as success\n\t}\n\tif isInUse(err) {\n\t\t// detach/delete dependent ports, then retry with backoff\n\t}\n\treturn fmt.Errorf(\"error revoking SecurityGroup: %w\", err)\n}","preventionTips":["Delete instances/ports/load balancers before removing their security groups.","Avoid concurrent kops applies or manual `openstack security group delete` during teardown.","Check credentials/region validity before running delete operations.","Retry idempotently: treat 404 as success on deletion."],"tags":["openstack","security-group","neutron","delete"],"backgroundTag":"resource-in-use","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}