{"record":{"id":"98c4638aceb00b09","repo":"kubernetes/kops","slug":"unexpected-target-type-for-deletion-t-98c463","errorCode":null,"errorMessage":"unexpected target type for deletion: %T","messagePattern":"unexpected target type for deletion: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/securitygroup.go","lineNumber":249,"sourceCode":"type deleteSecurityGroupRule struct {\n\trule *ec2types.SecurityGroupRule\n}\n\nfunc buildDeleteSecurityGroupRule(rule ec2types.SecurityGroupRule) *deleteSecurityGroupRule {\n\td := &deleteSecurityGroupRule{}\n\td.rule = &rule\n\treturn d\n}\n\nvar _ fi.CloudupDeletion = (*deleteSecurityGroupRule)(nil)\n\nfunc (d *deleteSecurityGroupRule) Delete(t fi.CloudupTarget) error {\n\tctx := context.TODO()\n\tklog.V(2).Infof(\"deleting security group permission: %v\", fi.DebugAsJsonString(d.rule))\n\n\tawsTarget, ok := t.(*awsup.AWSAPITarget)\n\tif !ok {\n\t\treturn fmt.Errorf(\"unexpected target type for deletion: %T\", t)\n\t}\n\n\tif aws.ToBool(d.rule.IsEgress) {\n\t\trequest := &ec2.RevokeSecurityGroupEgressInput{\n\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}\n\n\t\tklog.V(2).Infof(\"Calling EC2 RevokeSecurityGroupEgress\")\n\t\t_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error revoking SecurityGroupEgress: %v\", err)\n\t\t}\n\t} else {\n\t\trequest := &ec2.RevokeSecurityGroupIngressInput{\n\t\t\tGroupId:              d.rule.GroupId,\n\t\t\tSecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},\n\t\t}","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/securitygroup.go#L231-L267","documentation":"deleteSecurityGroupRule.Delete asserts the target is an *awsup.AWSAPITarget before calling EC2 RevokeSecurityGroupEgress/Ingress. kOps throws this when deletion is invoked against some other target type (e.g., a dry-run/target-less target), since revocation requires the real AWS API.","triggerScenarios":"Deletion of a security group rule (from FindDeletions results) is executed with a target other than AWSAPITarget — e.g., a dry-run Target, Terraform target, or a test target reaching the delete path.","commonSituations":"Running kops delete/apply flows where orphaned security group rules are garbage-collected under a non-apply target; test harnesses or internal tooling invoking task deletion with the wrong target; kOps bugs mixing target types during targeted deletions.","solutions":["Ensure rule deletion runs only under the AWS apply target (kops update --yes / apply phase), not dry-run or terraform targets","If seen in dry-run, expect deletion to be skipped/errored by design — run with the AWS target to actually revoke","Check kOps version for known bugs around deletion target handling and upgrade","Inspect --v=2 logs to see which target was passed to Delete"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// ensure deletion runs in apply mode\n// kops update cluster --yes  (not --dry-run / --target=terraform)","typeGuard":"if _, ok := target.(*awsup.AWSAPITarget); !ok {\n  return fmt.Errorf(\"security group rule deletion requires the AWS API target, got %T\", target)\n}","tryCatchPattern":"if err := kopsUpdateYes(); err != nil && strings.Contains(err.Error(), \"unexpected target type\") {\n  // re-run under the AWS apply target\n}","preventionTips":["Run rule garbage-collection only with the AWS apply target","Avoid custom tooling invoking task Delete with dry-run/terraform targets","Keep kOps up to date for target-handling fixes"],"tags":["aws","security-group","target-type","deletion"],"backgroundTag":"unexpected-target-type","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}