{"record":{"id":"6223e47e0f0afc0d","repo":"kubernetes/kops","slug":"error-creating-server-group-v","errorCode":null,"errorMessage":"error creating server group: %v","messagePattern":"error creating server group: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/server_group.go","lineNumber":45,"sourceCode":"\t\"k8s.io/apimachinery/pkg/util/wait\"\n\t\"k8s.io/klog/v2\"\n\t\"k8s.io/kops/pkg/apis/kops\"\n\t\"k8s.io/kops/pkg/cloudinstances\"\n\t\"k8s.io/kops/upup/pkg/fi\"\n\t\"k8s.io/kops/util/pkg/vfs\"\n)\n\nfunc (c *openstackCloud) CreateServerGroup(opt servergroups.CreateOptsBuilder) (*servergroups.ServerGroup, error) {\n\treturn createServerGroup(c, opt)\n}\n\nfunc createServerGroup(c OpenstackCloud, opt servergroups.CreateOptsBuilder) (*servergroups.ServerGroup, error) {\n\tvar i *servergroups.ServerGroup\n\n\tdone, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {\n\t\tv, err := servergroups.Create(context.TODO(), c.ComputeClient(), opt).Extract()\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error creating server group: %v\", err)\n\t\t}\n\t\ti = v\n\t\treturn true, nil\n\t})\n\tif err != nil {\n\t\treturn i, err\n\t} else if done {\n\t\treturn i, nil\n\t} else {\n\t\treturn i, wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) ListServerGroups(opts servergroups.ListOptsBuilder) ([]servergroups.ServerGroup, error) {\n\treturn listServerGroups(c, opts)\n}\n\nfunc listServerGroups(c OpenstackCloud, opts servergroups.ListOptsBuilder) ([]servergroups.ServerGroup, error) {","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/server_group.go#L27-L63","documentation":"createServerGroup wraps the Gophercloud servergroups.Create call (Nova compute API POST /os-server-groups). If the OpenStack API rejects the create or the HTTP request fails, the underlying Gophercloud error is wrapped as \"error creating server group: %v\" and returned after the retry backoff is exhausted or immediately on a non-retryable failure. It means kOps could not create the anti-affinity/affinity server group needed to place instance-group members.","triggerScenarios":"servergroups.Create(c.ComputeClient(), opt) returns an error: invalid or unsupported policy in CreateOpts (e.g. 'anti-affinity' policy not enabled by the Nova policy), a 401/403 from expired or insufficient-scope Keystone credentials, a 404 because the compute service/endpoint is missing in the catalog, a 409 quota or conflict response, or a network failure contacting the compute endpoint.","commonSituations":"Wrong OS_* environment variables or stale Keystone token; cloud admin disabled the server-group policy; tenant hit its server-group quota; kOps cluster config references a compute microversion or region lacking the server-groups extension; temporary nova-api outage or LB timeout between kOps and OpenStack.","solutions":["Verify credentials and endpoint: run 'openstack server group list' with the same OS_* environment to confirm auth and that the compute API is reachable.","Confirm the server group policy (e.g. anti-affinity) is supported/enabled by the cloud's Nova deployment; adjust Cluster.Spec topology or the policy value if not.","Check the project's server-group quota ('openstack quota show') and request an increase or delete unused server groups.","Inspect the wrapped Gophercloud error for HTTP status: 401/403 -> re-authenticate/fix roles; 404 -> fix region/interface in the provider config; 409 -> resolve quota/conflict.","Re-run after transient nova-api failures; the internal vfs.RetryWithBackoff already retries, so persistent errors are real config/API problems."],"exampleFix":"// before: policy not supported by cloud\nopt := servergroups.CreateOpts{Name: name, Policies: []string{\"anti-affinity\"}}\n// after: fall back to soft policy the cloud supports\npolicies := []string{\"anti-affinity\"}\nif cloudDoesNotSupportStrictAntiAffinity {\n\tpolicies = []string{\"soft-anti-affinity\"}\n}\nopt := servergroups.CreateOpts{Name: name, Policies: policies}","handlingStrategy":"try-catch","validationCode":"// Before creating, verify auth, endpoint and quota\nout, err := exec.Command(\"openstack\", \"server\", \"group\", \"list\").CombinedOutput()\nif err != nil {\n\treturn fmt.Errorf(\"openstack compute API not usable with current credentials: %s: %w\", out, err)\n}","typeGuard":null,"tryCatchPattern":"sg, err := cloud.CreateServerGroup(opt)\nif err != nil {\n\tvar gerr gophercloud.ErrUnexpectedResponseCode\n\tif errors.As(err, &gerr) {\n\t\tswitch gerr.Actual {\n\t\tcase 401, 403:\n\t\t\treturn fmt.Errorf(\"auth/permission problem creating server group: %w\", err) // fix credentials/roles\n\t\tcase 409:\n\t\t\treturn fmt.Errorf(\"server group quota or conflict: %w\", err) // raise quota, delete unused groups\n\t\t}\n\t}\n\tif errors.Is(err, wait.ErrWaitTimeout) {\n\t\treturn fmt.Errorf(\"server group creation timed out after retries: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Validate OS_* credentials and compute endpoint with a cheap call (server group list) before cluster creation.","Confirm the cloud supports the requested server group policy before provisioning.","Monitor project server-group quota and clean up groups from failed runs.","Keep the Nova compute service region/interface in the kOps config consistent with the credential scope."],"tags":["openstack","nova","server-group","api-error"],"backgroundTag":"openstack-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}