{"record":{"id":"3b91d79090d297ed","repo":"kubernetes/kops","slug":"error-listing-security-group-rules-v-v","errorCode":null,"errorMessage":"error listing security group rules %v: %v","messagePattern":"error listing security group rules (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/security_group.go","lineNumber":92,"sourceCode":"\t\treturn group, err\n\t} else if done {\n\t\treturn group, nil\n\t} else {\n\t\treturn group, wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) ListSecurityGroupRules(opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {\n\treturn listSecurityGroupRules(c, opt)\n}\n\nfunc listSecurityGroupRules(c OpenstackCloud, opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {\n\tvar rules []sgr.SecGroupRule\n\n\tdone, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {\n\t\tallPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error listing security group rules %v: %v\", opt, err)\n\t\t}\n\n\t\trs, err := sgr.ExtractRules(allPages)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error extracting security group rules from pages: %v\", err)\n\t\t}\n\t\trules = rs\n\t\treturn true, nil\n\t})\n\tif err != nil {\n\t\treturn rules, err\n\t} else if done {\n\t\treturn rules, nil\n\t} else {\n\t\treturn rules, wait.ErrWaitTimeout\n\t}\n}\n","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/security_group.go#L74-L110","documentation":"This error is returned by listSecurityGroupRules when the OpenStack Neutron security-group-rules List API call fails while paging through results inside vfs.RetryWithBackoff. It wraps the gophercloud SDK error with the ListOpts that were used, so it indicates an API-level failure (auth, connectivity, 403/404, invalid filter) rather than a problem parsing the response. After exhausting retries the wrapped error propagates to the caller of listSecurityGroupRules.","triggerScenarios":"sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO()) returns an error: Neutron endpoint unreachable, authentication token expired/revoked, the security group or project referenced by opt filters does not exist, or the caller lacks networking API permissions.","commonSituations":"Misconfigured OS_* cloud credentials or expired tokens, wrong region/endpoint in the cloud config, Neutron service down or at its API rate limit, a kOps cluster spec referencing a security group that was deleted out-of-band, or RBAC policy denying security-group-rule listing.","solutions":["Verify OpenStack credentials and that the Neutron (networking) endpoint is reachable, e.g. `openstack security group rule list`","Check that the security group IDs / filters in sgr.ListOpts still exist in the target project","Inspect the wrapped inner error for HTTP status: 401/403 fix auth or RBAC, 404 fix the ID, 429 slow down (backoff already retries)","Confirm the kops cloud config points at the correct region/project"],"exampleFix":"// before\nallPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())\nif err != nil { return false, fmt.Errorf(...) }\n// after (verify group exists first)\nsg, err := clusters.Get(context.TODO(), c.NetworkingClient(), opt.SecurityGroupID).Extract()\nif err != nil { return false, fmt.Errorf(\"security group %q not found: %v\", opt.SecurityGroupID, err) }\nallPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())","handlingStrategy":"retry","validationCode":"// before calling listSecurityGroupRules\nsg, err := groups.Get(ctx, cloud.NetworkingClient(), sgID).Extract()\nif err != nil {\n\treturn fmt.Errorf(\"security group %q not accessible: %w\", sgID, err)\n}\nif err := cloud.NetworkingClient().GetAuthResult().Err; err != nil {\n\treturn fmt.Errorf(\"neutron auth invalid: %w\", err)\n}","typeGuard":"func isAuthErr(err error) bool {\n\tvar e1 gophercloud.ErrDefault401\n\tvar e3 gophercloud.ErrDefault403\n\treturn errors.As(err, &e1) || errors.As(err, &e3)\n}","tryCatchPattern":"rules, err := listSecurityGroupRules(c, sgr.ListOpts{SecurityGroupID: sgID})\nif err != nil {\n\tif isAuthErr(err) {\n\t\t// reauthenticate / fix credentials, then retry once\n\t}\n\treturn fmt.Errorf(\"listing rules for sg %s: %w\", sgID, err)\n}","preventionTips":["Validate OS_* credentials with a cheap authed call before cluster operations","Keep gophercloud dependency in sync with the target OpenStack release","Check `openstack security group show <id>` before programmatic listing","Watch for 429s; rely on the built-in vfs.RetryWithBackoff instead of hammering"],"tags":["openstack","neutron","security-group","api-error"],"backgroundTag":"openstack-neutron-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}