{"record":{"id":"4d8a005d78785317","repo":"kubernetes/kops","slug":"error-deleting-security-group-rule-v","errorCode":null,"errorMessage":"error deleting security group rule: %v","messagePattern":"error deleting security group rule: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/security_group.go","lineNumber":167,"sourceCode":"\t})\n\tif err != nil {\n\t\treturn err\n\t} else if done {\n\t\treturn nil\n\t} else {\n\t\treturn wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) DeleteSecurityGroupRule(ruleID string) error {\n\treturn deleteSecurityGroupRule(c, ruleID)\n}\n\nfunc deleteSecurityGroupRule(c OpenstackCloud, ruleID string) error {\n\tdone, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {\n\t\terr := sgr.Delete(context.TODO(), c.NetworkingClient(), ruleID).ExtractErr()\n\t\tif err != nil && !isNotFound(err) {\n\t\t\treturn false, fmt.Errorf(\"error deleting security group rule: %v\", err)\n\t\t}\n\t\treturn true, nil\n\t})\n\tif err != nil {\n\t\treturn err\n\t} else if done {\n\t\treturn nil\n\t} else {\n\t\treturn wait.ErrWaitTimeout\n\t}\n}\n","sourceCodeStart":149,"sourceCodeEnd":179,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/security_group.go#L149-L179","documentation":"This error is returned by deleteSecurityGroupRule when the Neutron security-group-rule Delete API fails with an error other than 404 Not Found, inside the writeBackoff retry loop. As with deleteSecurityGroup, a 404 is treated as success because the desired end state (rule gone) is already achieved. Any other error — auth failure, connectivity, or conflict — is wrapped and propagated after retries.","triggerScenarios":"sgr.Delete(context.TODO(), c.NetworkingClient(), ruleID).ExtractErr() returns an error where isNotFound(err) is false: expired/invalid token, RBAC denial, Neutron unreachable, or a 409 because the rule/group is concurrently being mutated.","commonSituations":"Teardown running after the token expired, rule already deleted by a concurrent reconcile (should surface as 404 and be ignored), or the rule ID no longer belonging to the caller's project (403/404 semantics differ across Neutron versions).","solutions":["Confirm the rule ID exists in the right project (`openstack security group rule show <id>`); a genuinely missing rule is already handled as success","Refresh OpenStack credentials if the wrapped error is 401","Check RBAC policy on the networking service if 403","Rerun the operation — writeBackoff retries transient 5xx/429 failures"],"exampleFix":"// before\nerr := sgr.Delete(context.TODO(), c.NetworkingClient(), ruleID).ExtractErr()\n// after: pre-check existence to surface wrong-project/ID problems clearly\nrule, err := sgr.Get(context.TODO(), c.NetworkingClient(), ruleID).Extract()\nif err != nil { return fmt.Errorf(\"rule %q not accessible: %v\", ruleID, err) }\n_ = rule\nerr = sgr.Delete(context.TODO(), c.NetworkingClient(), ruleID).ExtractErr()","handlingStrategy":"try-catch","validationCode":"_, err := sgr.Get(ctx, cloud.NetworkingClient(), ruleID).Extract()\nif err != nil {\n\tif gophercloud.ResponseCodeIs(err, 404) { return nil } // already deleted\n\treturn fmt.Errorf(\"rule %q not accessible before delete: %w\", ruleID, err)\n}","typeGuard":"func isRuleNotFound(err error) bool {\n\tvar nf gophercloud.ErrDefault404\n\treturn errors.As(err, &nf)\n}","tryCatchPattern":"err := deleteSecurityGroupRule(c, ruleID)\nif err != nil {\n\tif isRuleNotFound(err) { return nil } // treat as success\n\tvar e401 gophercloud.ErrDefault401\n\tif errors.As(err, &e401) { /* reauthenticate and retry */ }\n\treturn fmt.Errorf(\"deleting rule %s: %w\", ruleID, err)\n}","preventionTips":["Handle concurrent teardowns gracefully — 404 means the rule is already gone","Refresh tokens before long-running delete phases","Verify rule IDs belong to the current project to avoid 403/404 confusion","Keep delete operations idempotent so re-running teardown is safe"],"tags":["openstack","neutron","security-group","deletion-failed"],"backgroundTag":"openstack-neutron-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}