{"record":{"id":"4f1368d3205072af","repo":"kubernetes/kops","slug":"found-multiple-securitygroups-with-name-s","errorCode":null,"errorMessage":"found multiple SecurityGroups with name: %s","messagePattern":"found multiple SecurityGroups with name: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/securitygroup.go","lineNumber":77,"sourceCode":"\tif s.RemoveGroup {\n\t\treturn s, nil\n\t}\n\treturn getSecurityGroupByName(s, cloud)\n}\n\nfunc getSecurityGroupByName(s *SecurityGroup, cloud openstack.OpenstackCloud) (*SecurityGroup, error) {\n\topt := sg.ListOpts{\n\t\tName: fi.ValueOf(s.Name),\n\t}\n\tgs, err := cloud.ListSecurityGroups(opt)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tn := len(gs)\n\tif n == 0 {\n\t\treturn nil, nil\n\t} else if n != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple SecurityGroups with name: %s\", fi.ValueOf(s.Name))\n\t}\n\tg := gs[0]\n\tactual := &SecurityGroup{\n\t\tID:          new(g.ID),\n\t\tName:        new(g.Name),\n\t\tDescription: new(g.Description),\n\t\tLifecycle:   s.Lifecycle,\n\t}\n\tactual.RemoveExtraRules = s.RemoveExtraRules\n\tactual.RemoveGroup = s.RemoveGroup\n\ts.ID = actual.ID\n\treturn actual, nil\n}\n\nfunc (s *SecurityGroup) Run(context *fi.CloudupContext) error {\n\treturn fi.CloudupDefaultDeltaRunMethod(s, context)\n}\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/securitygroup.go#L59-L95","documentation":"Raised by getSecurityGroupByName (securitygroup.go:77), which is used by SecurityGroup.Find, NewLBTaskFromCloud, and FindDeletions to resolve a security group by its name. Neutron security group names are only unique per project; if listing by name returns more than one group, kOps cannot determine which one to adopt and fails fast instead of mutating the wrong group.","triggerScenarios":"cloud.ListSecurityGroups(ListOpts{Name: ...}) returns 2+ groups: someone manually duplicated the cluster's security group, a previous kOps run created a group and then the task's ID was lost (so the next run created another with the same name), or groups with the same name exist across tenants visible to an admin-scoped client.","commonSituations":"Operator created a test SG with the same name as the cluster SG; leftover SGs from a deleted cluster in the same project; kOps ID state lost after a failed apply causing duplicate creation; running with admin credentials where cross-project SGs with matching names are listed.","solutions":["List the duplicates: `openstack security group list --name <sg-name>` and note their IDs","Determine the correct group (created by kOps, attached to cluster instances/LB) via `openstack port show` / LB listeners","Delete the stale duplicates: `openstack security group delete <dup-id>`","Re-run `kops update cluster`; going forward, avoid creating security groups that collide with cluster SG names"],"exampleFix":"// before\n$ openstack security group list --name nodes.<cluster>\n+------------+-----------------+\n| id         | name            |\n| abc123     | nodes.<cluster> |\n| def456     | nodes.<cluster> |\n// after\n$ openstack security group delete def456\n$ kops update cluster <name> --yes","handlingStrategy":"validation","validationCode":"// before applying, detect duplicate SG names in the project\ngroups, _ := groups.List(netClient, groups.ListOpts{Name: sgName}).AllPages()\nif len(groups) > 1 { return fmt.Errorf(\"%d security groups named %q exist; delete duplicates first\", len(groups), sgName) }","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil {\n    if strings.Contains(err.Error(), \"found multiple SecurityGroups\") {\n        log.Fatal(\"list duplicates with `openstack security group list --name <name>` and delete the stale one\")\n    }\n    return err\n}","preventionTips":["Never create security groups with names matching kOps cluster SGs (nodes./masters./api-LB patterns)","Delete leftover SGs from removed clusters in the same project","Prefer unique, cluster-specific SG names in the cluster spec","Avoid admin-scoped credentials for applies, which can surface cross-project name collisions"],"tags":["openstack","security-group","neutron","duplicate-resources"],"backgroundTag":"multiple-matching-resources-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}