{"record":{"id":"f60e8b23d8aca02c","repo":"kubernetes/kops","slug":"error-creating-network-task-from-cloud-v","errorCode":null,"errorMessage":"error creating network task from cloud: %v","messagePattern":"error creating network task from cloud: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/openstacktasks/subnet.go","lineNumber":65,"sourceCode":"\t\t}\n\t}\n\treturn deps\n}\n\nvar _ fi.CompareWithID = (*Subnet)(nil)\n\nfunc (s *Subnet) CompareWithID() *string {\n\treturn s.ID\n}\n\nfunc NewSubnetTaskFromCloud(cloud openstack.OpenstackCloud, lifecycle fi.Lifecycle, subnet *subnets.Subnet, find *Subnet) (*Subnet, error) {\n\tnetwork, err := cloud.GetNetwork(subnet.NetworkID)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"NewSubnetTaskFromCloud: Failed to get network with ID %s: %v\", subnet.NetworkID, err)\n\t}\n\tnetworkTask, err := NewNetworkTaskFromCloud(cloud, lifecycle, network, find.Tag)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error creating network task from cloud: %v\", err)\n\t}\n\n\tnameservers := make([]*string, len(subnet.DNSNameservers))\n\tfor i, ns := range subnet.DNSNameservers {\n\t\tnameservers[i] = new(ns)\n\t}\n\n\ttag := \"\"\n\tif find != nil && fi.ArrayContains(subnet.Tags, fi.ValueOf(find.Tag)) {\n\t\ttag = fi.ValueOf(find.Tag)\n\t}\n\n\tactual := &Subnet{\n\t\tID:         new(subnet.ID),\n\t\tName:       new(subnet.Name),\n\t\tNetwork:    networkTask,\n\t\tCIDR:       new(subnet.CIDR),\n\t\tLifecycle:  lifecycle,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/openstacktasks/subnet.go#L47-L83","documentation":"After resolving the parent network, NewSubnetTaskFromCloud calls NewNetworkTaskFromCloud to build the corresponding Network task. This error wraps any failure from constructing that Network task (e.g. failure to fetch the network's router:external info or tags), so the Subnet task cannot be assembled. It is raised during Find reconciliation of subnet state.","triggerScenarios":"Subnet.Find -> NewSubnetTaskFromCloud -> NewNetworkTaskFromCloud returns an error — the network object retrieved from GetNetwork could not be converted into a Network task, e.g. an error fetching extended network attributes (external router info) from Neutron or an unexpected nil/invalid network payload.","commonSituations":"Neutron lacks the router:external extension or the policy hides that attribute for the caller's role; Neutron returned a partially-populated network object (5xx degraded response); kOps/gophercloud version mismatch with the cloud's Neutron API microversion.","solutions":["Check kOps logs for the wrapped inner error from NewNetworkTaskFromCloud to identify the underlying Neutron failure.","Verify the credentials' role can read network extensions: `openstack network show <id> -f json` and confirm router:external is present.","If the Neutron extension is missing/disallowed, grant the kOps user a role with network extension visibility (e.g. admin or reader on the project).","Upgrade/downgrade kOps so its gophercloud Neutron client matches the cloud's API version; retry after any transient Neutron 5xx."],"exampleFix":"# inspect what the API returns\n$ openstack network show <networkID> -f json | grep -i external\n# if absent due to policy, grant visibility to the kOps user, then re-run:\nkops update cluster","handlingStrategy":"try-catch","validationCode":"// Confirm the Neutron router:external extension is readable before reconcile:\nnetwork, _ := cloud.GetNetwork(subnet.NetworkID)\next, err := cloud.GetNetworkExternal(network.ID) // or inspect network show output\nif err != nil {\n\treturn fmt.Errorf(\"cannot read router:external attribute for network %s; check role/extension support: %w\", network.ID, err)\n}","typeGuard":null,"tryCatchPattern":"networkTask, err := NewNetworkTaskFromCloud(cloud, lifecycle, network, find.Tag)\nif err != nil {\n\treturn nil, fmt.Errorf(\"error creating network task from cloud: %w\", err)\n}\n// On failure, verify with: openstack extension list | grep router\n// and ensure the kOps user role can read network extensions before retrying.","preventionTips":["Verify `openstack extension list` includes router-related extensions in your cloud before using kops on it.","Give the kOps credentials a role with visibility into network attributes (admin/reader).","Match kOps version to your OpenStack release; very old Neutron may lack attributes gophercloud expects.","Retry after transient Neutron 5xx; check the service with `openstack network list` first."],"tags":["openstack","neutron","subnet","network-task"],"backgroundTag":"neutron-extension-error","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}