{"record":{"id":"cb875a5d59b6724f","repo":"kubernetes/kops","slug":"error-creating-securitygroup-v-cb875a","errorCode":null,"errorMessage":"error creating SecurityGroup: %v","messagePattern":"error creating SecurityGroup: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/securitygroup.go","lineNumber":123,"sourceCode":"\t\tif changes.Name != nil {\n\t\t\treturn fi.CannotChangeField(\"Name\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (_ *SecurityGroup) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SecurityGroup) error {\n\tif a == nil {\n\t\tklog.V(2).Infof(\"Creating SecurityGroup with Name:%q\", fi.ValueOf(e.Name))\n\n\t\topt := sg.CreateOpts{\n\t\t\tName:        fi.ValueOf(e.Name),\n\t\t\tDescription: fi.ValueOf(e.Description),\n\t\t}\n\n\t\tg, err := t.Cloud.CreateSecurityGroup(opt)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating SecurityGroup: %v\", err)\n\t\t}\n\n\t\te.ID = new(g.ID)\n\t\treturn nil\n\t}\n\n\tklog.V(2).Infof(\"Openstack task SecurityGroup::RenderOpenstack did nothing\")\n\treturn nil\n}\n\nfunc (s *SecurityGroup) FindDeletions(c *fi.CloudupContext) ([]fi.CloudupDeletion, error) {\n\tvar removals []fi.CloudupDeletion\n\n\tif len(s.RemoveExtraRules) == 0 && !s.RemoveGroup {\n\t\treturn nil, nil\n\t}\n\n\tcloud := c.T.Cloud.(openstack.OpenstackCloud)","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/securitygroup.go#L105-L141","documentation":"This error is returned by SecurityGroup.RenderOpenstack when the OpenstackAPITarget's call to Cloud.CreateSecurityGroup fails while provisioning a new Neutron security group during a kOps cluster apply. It wraps the underlying gophercloud/Neutron error (e.g. auth failure, quota exceeded, name conflict, network service unavailable). The formatted message always reads \"error creating SecurityGroup: <underlying error>\" and aborts the render of the security group task.","triggerScenarios":"RenderOpenstack with a==nil (the group does not yet exist) calls t.Cloud.CreateSecurityGroup(sg.CreateOpts{Name, Description}); any non-nil error from the Neutron POST /security_groups API is wrapped here. Typical causes: Keystone auth expired, Neutron quota (security_groups) exceeded, duplicate group name in the project when Neutron rejects it, or Neutron endpoint down/404.","commonSituations":"Clusters where the OpenStack project hit its security-group quota; misconfigured OS_* environment credentials causing 401; a stale group with the same name left from a failed previous run; Neutron outage or wrong --os-region / endpoint config.","solutions":["Read the wrapped '%v' detail to identify the underlying Neutron error (401 auth, 409 conflict, 403 quota).","If quota exceeded (403 with quota message), delete unused security groups in the project or ask the cloud admin to raise the quota.","If a duplicate group name exists, remove the stale group or reuse it (ensure the task's Find/getSecurityGroupByName can locate exactly one).","Verify credentials and region (openstack token issue / openstack catalog list) and re-run kops update.","Check Neutron service health/endpoint; retry the apply once the API is reachable."],"exampleFix":"// before: apply fails with opaque quota error\nkops update cluster --name mycluster\n// error creating SecurityGroup: Request forbidden: Maximum number of security groups exceeded\n// after: raise or free quota, then retry\nopenstack security group list  # find unused groups\nopenstack security group delete <stale-id>\nkops update cluster --name mycluster --yes","handlingStrategy":"try-catch","validationCode":"// before apply: verify auth and group quota/name\nsess, _ := openstack.AuthenticatedClient(provider)\nneutron, _ := openstack.NewNetworkV2(provider, eo)\npage, _ := groups.List(neutron, groups.ListOpts{Name: name}).AllPages()\nlist, _ := groups.ExtractGroups(page)\nif len(list) > 0 { // group already exists; task will update instead of create\n}","typeGuard":"func isOpenstackQuotaErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"quota\")\n}","tryCatchPattern":"err := target.Cloud.CreateSecurityGroup(opt)\nif err != nil {\n\tif strings.Contains(err.Error(), \"401\") || strings.Contains(err.Error(), \"authentication\") {\n\t\t// re-authenticate and retry\n\t} else if strings.Contains(err.Error(), \"quota\") {\n\t\t// free up or request higher security group quota\n\t}\n\treturn fmt.Errorf(\"error creating SecurityGroup: %w\", err)\n}","preventionTips":["Pre-check security group quota with `openstack quota show` before large applies.","Ensure OS_* credentials and region are valid (`openstack token issue`) before running kops.","Avoid duplicate group names; let kops Find/reuse existing groups instead of manually creating them.","Monitor Neutron service status before cluster operations."],"tags":["openstack","security-group","neutron","cloud-provisioning"],"backgroundTag":"openstack-api-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}