{"record":{"id":"93a18c110819a4ef","repo":"kubernetes/kops","slug":"failed-to-get-port-with-id-s-v","errorCode":null,"errorMessage":"Failed to get port with id %s: %v","messagePattern":"Failed to get port with id (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/lb.go","lineNumber":239,"sourceCode":"\t\te.VipSubnet = new(lb.VipSubnetID)\n\t\te.Provider = new(lb.Provider)\n\t\te.FlavorID = new(lb.FlavorID)\n\n\t\tif e.SecurityGroup != nil {\n\t\t\topts := ports.UpdateOpts{\n\t\t\t\tSecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},\n\t\t\t}\n\t\t\t_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), lb.VipPortID, opts).Extract()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"Failed to update security group for port %s: %v\", lb.VipPortID, err)\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\t// We may have failed to update the security groups on the load balancer\n\tport, err := t.Cloud.GetPort(fi.ValueOf(a.PortID))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Failed to get port with id %s: %v\", fi.ValueOf(a.PortID), err)\n\t}\n\t// Ensure the loadbalancer port has one security group and it is the one specified,\n\tif e.SecurityGroup != nil &&\n\t\t(len(port.SecurityGroups) < 1 || port.SecurityGroups[0] != fi.ValueOf(e.SecurityGroup.ID)) {\n\n\t\topts := ports.UpdateOpts{\n\t\t\tSecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},\n\t\t}\n\t\t_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), fi.ValueOf(a.PortID), opts).Extract()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to update security group for port %s: %v\", fi.ValueOf(a.PortID), err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tklog.V(2).Infof(\"Openstack task LB::RenderOpenstack did nothing\")\n\treturn nil\n}","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/lb.go#L221-L257","documentation":"On the update path, kOps fetches the LB's existing VIP port (t.Cloud.GetPort) to verify its security groups. This error means that port GET failed, so kOps cannot reconcile the LB security group state.","triggerScenarios":"Existing-LB reconcile (`kops update cluster`/`kops replace`) where the port identified by a.PortID cannot be fetched — the LB was deleted out-of-band, the port ID is stale in the kops state store, or the Neutron API call failed (403/404/timeout).","commonSituations":"Someone deleted the Octavia LB directly in OpenStack while kops state still references it; credentials scoped to a project that cannot see the port; neutron outage during update.","solutions":["Check if the LB still exists: `openstack loadbalancer show <id>`; if deleted, remove it from kops state (`kops delete instancegroup`/edit cluster or re-import) so it is recreated","Run `openstack port show <port-id>` with the same credentials to confirm visibility/permissions","Inspect the wrapped error for 403 — request port:show permission for the kOps user","Retry after confirming neutron API health"],"exampleFix":"// before: stale LB in state store after manual deletion\nkops update cluster --name mycluster\n// error: Failed to get port with id ...: resource not found\n// after: reconcile cloud state first\nkops delete cluster --name mycluster --yes   # or recreate the LB in OpenStack\nkops update cluster --name mycluster --yes","handlingStrategy":"validation","validationCode":"// Before updating the cluster, confirm the LB and its VIP port still exist\nopenstack port show $(kops toolbox dump cluster -o json | jq -r './/.portId // empty') 2>/dev/null || \\\n  echo 'LB port missing from cloud — state store is stale'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never delete Octavia load balancers directly in OpenStack; use kops-managed deletion","Compare `openstack port list` against kops state when a manual cleanup was required","Ensure the OS_* project used by kOps can see the LB ports (same tenant or admin role)"],"tags":["openstack","neutron","port","state-drift"],"backgroundTag":"cloud-resource-not-found","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}