{"record":{"id":"379e386ddfaf68cd","repo":"kubernetes/kops","slug":"additional-securitygroup-not-found-for-name-s","errorCode":null,"errorMessage":"Additional SecurityGroup not found for name %s","messagePattern":"Additional SecurityGroup not found for name (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/port.go","lineNumber":315,"sourceCode":"\tklog.V(2).Infof(\"Using an existing Openstack port, id=%s\", fi.ValueOf(e.ID))\n\treturn nil\n}\n\nfunc portCreateOptsFromPortTask(t *openstack.OpenstackAPITarget, a, e, changes *Port) (ports.CreateOptsBuilder, error) {\n\tsgs := make([]string, len(e.SecurityGroups)+len(e.AdditionalSecurityGroups))\n\tfor i, sg := range e.SecurityGroups {\n\t\tsgs[i] = fi.ValueOf(sg.ID)\n\t}\n\tfor i, sg := range e.AdditionalSecurityGroups {\n\t\topt := secgroup.ListOpts{\n\t\t\tName: sg,\n\t\t}\n\t\tgs, err := t.Cloud.ListSecurityGroups(opt)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tif len(gs) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"Additional SecurityGroup not found for name %s\", sg)\n\t\t}\n\t\tsgs[i+len(e.SecurityGroups)] = gs[0].ID\n\t}\n\tfixedIPs := make([]ports.IP, len(e.Subnets))\n\tfor i, subn := range e.Subnets {\n\t\tfixedIPs[i] = ports.IP{\n\t\t\tSubnetID: fi.ValueOf(subn.ID),\n\t\t}\n\t}\n\n\treturn ports.CreateOpts{\n\t\tName:                fi.ValueOf(e.Name),\n\t\tNetworkID:           fi.ValueOf(e.Network.ID),\n\t\tSecurityGroups:      &sgs,\n\t\tFixedIPs:            fixedIPs,\n\t\tAllowedAddressPairs: e.AllowedAddressPairs,\n\t}, nil\n}","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/port.go#L297-L333","documentation":"portCreateOptsFromPortTask resolves each additional security group by name via t.Cloud.ListSecurityGroups and requires exactly one match to fill the port's security_groups option. When zero groups match, it returns this error naming the missing group. Note the implementation silently continues if the list call itself errors, so this error specifically means 'the lookup succeeded but found nothing'.","triggerScenarios":"e.SecurityGroups (additional security groups beyond the default ones) contains a name for which ListSecurityGroups returns an empty result while building ports.CreateOpts.","commonSituations":"Typo in a security group name in the cluster spec; security group created in another project/region; security group deleted out-of-band; cluster spec referencing AWS-style group names on Openstack.","solutions":["Check the group name in the error against `openstack security group list` in the target project","Create the missing security group or correct the name in the cluster spec","Ensure kops is pointed at the same Openstack project where the group exists","Re-run kops after the fix"],"exampleFix":"// before (cluster.yaml)\nadditionalSecurityGroups:\n- sg-loadbalancers\n// after\nadditionalSecurityGroups:\n- loadbalancers-sg  # name exactly as it exists in the project","handlingStrategy":"validation","validationCode":"for _, sgName := range additionalSecurityGroups {\n    gs, err := cloud.ListSecurityGroups(securitygroups.ListOpts{Name: sgName})\n    if err != nil {\n        return fmt.Errorf(\"cannot list security groups: %v\", err)\n    }\n    if len(gs) == 0 {\n        return fmt.Errorf(\"Additional SecurityGroup not found for name %s\", sgName)\n    }\n}","typeGuard":null,"tryCatchPattern":"gs, err := t.Cloud.ListSecurityGroups(opt)\nif err != nil {\n    continue // NOTE: current code swallows list errors; handle explicitly in your own wrapper\n}\nif len(gs) == 0 {\n    return nil, fmt.Errorf(\"Additional SecurityGroup not found for name %s\", sg)\n}","preventionTips":["Cross-check every security group name in the cluster spec against `openstack security group list`","Create required security groups before running kops","Ensure kops credentials target the same project as the groups"],"tags":["openstack","neutron","security-groups"],"backgroundTag":"resource-not-found-by-name","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}