{"record":{"id":"c2b8d7aacf13b8e0","repo":"kubernetes/kops","slug":"error-updating-lb-listener-v","errorCode":null,"errorMessage":"error updating LB listener: %v","messagePattern":"error updating LB listener: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/lblistener.go","lineNumber":178,"sourceCode":"\n\t\tif useVIPACL && (fi.ValueOf(e.Pool.Loadbalancer.Provider) != \"ovn\") {\n\t\t\tlisteneropts.AllowedCIDRs = e.AllowedCIDRs\n\t\t}\n\n\t\tlistener, err := t.Cloud.CreateListener(listeneropts)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating LB listener: %v\", err)\n\t\t}\n\t\te.ID = new(listener.ID)\n\t\treturn nil\n\t} else if len(changes.AllowedCIDRs) > 0 {\n\t\tif useVIPACL && (fi.ValueOf(a.Pool.Loadbalancer.Provider) != \"ovn\") {\n\t\t\topts := listeners.UpdateOpts{\n\t\t\t\tAllowedCIDRs: &changes.AllowedCIDRs,\n\t\t\t}\n\t\t\t_, err := listeners.Update(context.TODO(), t.Cloud.LoadBalancerClient(), fi.ValueOf(a.ID), opts).Extract()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error updating LB listener: %v\", err)\n\t\t\t}\n\t\t} else {\n\t\t\tklog.V(2).Infof(\"Openstack Octavia VIPACLs not supported\")\n\t\t}\n\t\treturn nil\n\t}\n\tklog.V(2).Infof(\"Openstack task LB::RenderOpenstack did nothing\")\n\treturn nil\n}\n","sourceCodeStart":160,"sourceCodeEnd":188,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/lblistener.go#L160-L188","documentation":"Raised when the LBListener task detects changed AllowedCIDRs and calls Octavia's listeners.Update to refresh the VIP ACL allow-list. Any API error from PATCH /v2/lbaas/listeners/{id} is wrapped here. It only fires when VIP ACL support is enabled (UseLoadBalancerVIPACL) and the provider is not ovn; otherwise the update is silently skipped.","triggerScenarios":"kops update where cluster spec AllowedCIDRs changed (or --admin-access changed) and listeners.Update on the existing listener fails: invalid CIDR list, listener in immutable/PENDING state, 404 for stale listener ID, or auth failure.","commonSituations":"Operator runs `kops update cluster --admin-access=...`; the listener ID in state no longer exists because the LB was deleted out-of-band; Octavia version too old to support allowed_cidrs; provider is ovn but VIP ACL flag wrongly enabled (error would come from the API reject).","solutions":["Inspect the wrapped error; if 404, delete/recreate the load balancer task so a fresh listener ID is used (kops replace/delete the LB resources).","Validate each admin-access CIDR is a valid non-overlapping CIDR before updating.","Wait for the listener/load balancer to leave PENDING_* state, then re-run the update.","Confirm the Octavia deployment supports allowed_cidrs and that the provider is not ovn (ovn ignores VIP ACLs by design)."],"exampleFix":"// before: updating a deleted listener\n_, err := listeners.Update(ctx, client, fi.ValueOf(a.ID), opts).Extract()\n// after: re-listen if the ID is stale\nlistenerList, _ := listeners.List(client, listeners.ListOpts{Name: fi.ValueOf(a.Name)}).AllPages(ctx)\nitems, _ := listeners.ExtractListeners(listenerList)\nif len(items) > 0 && items[0].ID != fi.ValueOf(a.ID) {\n\treturn fmt.Errorf(\"listener %s not found; re-run cluster update to recreate\", fi.ValueOf(a.ID))\n}\n_, err := listeners.Update(ctx, client, items[0].ID, opts).Extract()","handlingStrategy":"validation","validationCode":"for _, cidr := range newAllowedCIDRs {\n\tif _, _, err := net.ParseCIDR(cidr); err != nil { return fmt.Errorf(\"invalid admin-access CIDR %q: %w\", cidr, err) }\n}\nlistener := octaviaListenerGet(listenerID)\nif listener == nil { return fmt.Errorf(\"listener %s missing; recreate LB before updating ACL\", listenerID) }\nif listener.ProvisioningStatus != \"ACTIVE\" { return fmt.Errorf(\"listener %s not ACTIVE\", listenerID) }","typeGuard":null,"tryCatchPattern":"if err := updateAdminAccess(cidrs); err != nil {\n\tvar notFound gophercloud.ErrDefault404\n\tif errors.As(err, &notFound) {\n\t\t// stale listener ID: recreate resources via kops replace\n\t\treturn recreateLoadBalancer()\n\t}\n\treturn err\n}","preventionTips":["Never delete Octavia LBs out-of-band while kops state references them.","Validate --admin-access CIDRs before applying.","Confirm the Octavia version supports allowed_cidrs and that ovn provider is not combined with VIP ACL settings."],"tags":["openstack","octavia","loadbalancer","vip-acl"],"backgroundTag":"octavia-listener-update-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}