{"record":{"id":"d2b4d33b49923fe3","repo":"kubernetes/kops","slug":"error-extracting-security-group-rules-from-pages","errorCode":null,"errorMessage":"error extracting security group rules from pages: %v","messagePattern":"error extracting security group rules from pages: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstack/security_group.go","lineNumber":97,"sourceCode":"\t}\n}\n\nfunc (c *openstackCloud) ListSecurityGroupRules(opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {\n\treturn listSecurityGroupRules(c, opt)\n}\n\nfunc listSecurityGroupRules(c OpenstackCloud, opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {\n\tvar rules []sgr.SecGroupRule\n\n\tdone, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {\n\t\tallPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error listing security group rules %v: %v\", opt, err)\n\t\t}\n\n\t\trs, err := sgr.ExtractRules(allPages)\n\t\tif err != nil {\n\t\t\treturn false, fmt.Errorf(\"error extracting security group rules from pages: %v\", err)\n\t\t}\n\t\trules = rs\n\t\treturn true, nil\n\t})\n\tif err != nil {\n\t\treturn rules, err\n\t} else if done {\n\t\treturn rules, nil\n\t} else {\n\t\treturn rules, wait.ErrWaitTimeout\n\t}\n}\n\nfunc (c *openstackCloud) CreateSecurityGroupRule(opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {\n\treturn createSecurityGroupRule(c, opt)\n}\n\nfunc createSecurityGroupRule(c OpenstackCloud, opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstack/security_group.go#L79-L115","documentation":"This error is returned when sgr.ExtractRules fails to decode the paginated Neutron security-group-rule response into []sgr.SecGroupRule. It means the API responded but the payload could not be parsed/extracted, which in practice indicates an unexpected response shape or an error page returned as a 200. The error is wrapped by vfs.RetryWithBackoff and retried, then propagated to callers of listSecurityGroupRules.","triggerScenarios":"sgr.ExtractRules(allPages) returns an error because the collected pages do not contain the expected JSON structure (e.g. an HTML error page from a proxy, a truncated response, or a Neutron microversion returning a different schema).","commonSituations":"A load balancer / API proxy intercepting Neutron responses, an outdated gophercloud SDK incompatible with the cloud's Neutron API version, or a misbehaving OpenStack deployment returning malformed bodies.","solutions":["Retry the operation; transient proxy/gateway errors often resolve (backoff already retries a few times)","Upgrade or align the gophercloud (openstack) dependency with the target cloud's Neutron API version","Capture the raw response body and check for an HTML/proxy error page instead of JSON","Verify no intermediate proxy is mangling the Neutron response"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// probe the API health/format before extracting\nresp, err := cloud.NetworkingClient().Get(cloud.NetworkingClient().EndpointURL(), nil, nil)\nif err != nil || resp.StatusCode != 200 {\n\treturn fmt.Errorf(\"neutron endpoint unhealthy or returning non-JSON: status=%v err=%v\", resp, err)\n}","typeGuard":"func isExtractionErr(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"extracting security group rules from pages\")\n}","tryCatchPattern":"rules, err := listSecurityGroupRules(c, opt)\nif err != nil {\n\tif isExtractionErr(err) {\n\t\t// log raw response, upgrade gophercloud, retry after backoff\n\t}\n\treturn err\n}","preventionTips":["Pin and regularly update the gophercloud SDK version","Ensure no proxy/LB rewrites Neutron error responses into HTML bodies","Log the failing page payload when extraction fails to spot schema drift","Add a smoke test listing SG rules against the target cloud in CI"],"tags":["openstack","neutron","security-group","response-parsing"],"backgroundTag":"api-response-parsing-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}