{"record":{"id":"4a8990981994e7e0","repo":"kubernetes/kops","slug":"failed-to-update-security-group-for-port-s-v","errorCode":null,"errorMessage":"Failed to update security group for port %s: %v","messagePattern":"Failed to update security group for port (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/lb.go","lineNumber":231,"sourceCode":"\t\t\tlbopts.FlavorID = fi.ValueOf(e.FlavorID)\n\t\t}\n\t\tlb, err := t.Cloud.CreateLB(lbopts)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating LB: %v\", err)\n\t\t}\n\t\te.ID = new(lb.ID)\n\t\te.PortID = new(lb.VipPortID)\n\t\te.VipSubnet = new(lb.VipSubnetID)\n\t\te.Provider = new(lb.Provider)\n\t\te.FlavorID = new(lb.FlavorID)\n\n\t\tif e.SecurityGroup != nil {\n\t\t\topts := ports.UpdateOpts{\n\t\t\t\tSecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},\n\t\t\t}\n\t\t\t_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), lb.VipPortID, opts).Extract()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"Failed to update security group for port %s: %v\", lb.VipPortID, err)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\t// We may have failed to update the security groups on the load balancer\n\tport, err := t.Cloud.GetPort(fi.ValueOf(a.PortID))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to get port with id %s: %v\", fi.ValueOf(a.PortID), err)\n\t}\n\t// Ensure the loadbalancer port has one security group and it is the one specified,\n\tif e.SecurityGroup != nil &&\n\t\t(len(port.SecurityGroups) < 1 || port.SecurityGroups[0] != fi.ValueOf(e.SecurityGroup.ID)) {\n\n\t\topts := ports.UpdateOpts{\n\t\t\tSecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},\n\t\t}\n\t\t_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), fi.ValueOf(a.PortID), opts).Extract()\n\t\tif err != nil {","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/lb.go#L213-L249","documentation":"After creating the load balancer, kOps attaches the configured security group to the LB's VIP port via the Neutron ports update API. This error means that ports.Update call failed, so the VIP port still has the default security groups.","triggerScenarios":"Fresh LB creation path (a == nil) where e.SecurityGroup is set and ports.Update on lb.VipPortID returns an error — typically 403 from Neutron policy, or the security group / port no longer exists.","commonSituations":"User's OpenStack role lacks update_port permission on the port owned by the octavia project; the referenced security group ID was deleted or lives in another project; transient neutron API failure during cluster create.","solutions":["Check the wrapped error for 403 — grant the user the neutron update_port policy permission (or use an admin-authorized deployment)","Verify the security group exists in the same project: `openstack security group show <id>`","Re-run `kops update cluster`; the reconcile loop retries port SG updates on existing LBs (see line 248 path)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-check SG exists and user can update ports\nopenstack security group show $SG_ID\nopenstack port show $LB_VIP_PORT_ID","typeGuard":null,"tryCatchPattern":"_, err = ports.Update(ctx, client, lb.VipPortID, opts).Extract()\nif err != nil {\n    var gerr gophercloud.ErrUnexpectedResponseCode\n    if errors.As(err, &gerr) && gerr.StatusCode == 403 {\n        return fmt.Errorf(\"missing neutron update_port permission for %s: %w\", lb.VipPortID, err)\n    }\n    return fmt.Errorf(\"Failed to update security group for port %s: %w\", lb.VipPortID, err)\n}","preventionTips":["Grant the kOps principal neutron update_port policy rights when octavia owns the VIP port","Keep the configured security group ID stable; never delete and recreate it without updating the cluster spec","Re-run `kops update cluster` after transient neutron failures — reconcile retries the SG update"],"tags":["openstack","security-group","neutron","permissions"],"backgroundTag":"insufficient-cloud-permissions","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}