kubernetes/kops · error

Additional SecurityGroup not found for name %s

Error message

Additional SecurityGroup not found for name %s

What it means

portCreateOptsFromPortTask resolves each additional security group by name via t.Cloud.ListSecurityGroups and requires exactly one match to fill the port's security_groups option. When zero groups match, it returns this error naming the missing group. Note the implementation silently continues if the list call itself errors, so this error specifically means 'the lookup succeeded but found nothing'.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/port.go:315

	klog.V(2).Infof("Using an existing Openstack port, id=%s", fi.ValueOf(e.ID))
	return nil
}

func portCreateOptsFromPortTask(t *openstack.OpenstackAPITarget, a, e, changes *Port) (ports.CreateOptsBuilder, error) {
	sgs := make([]string, len(e.SecurityGroups)+len(e.AdditionalSecurityGroups))
	for i, sg := range e.SecurityGroups {
		sgs[i] = fi.ValueOf(sg.ID)
	}
	for i, sg := range e.AdditionalSecurityGroups {
		opt := secgroup.ListOpts{
			Name: sg,
		}
		gs, err := t.Cloud.ListSecurityGroups(opt)
		if err != nil {
			continue
		}
		if len(gs) == 0 {
			return nil, fmt.Errorf("Additional SecurityGroup not found for name %s", sg)
		}
		sgs[i+len(e.SecurityGroups)] = gs[0].ID
	}
	fixedIPs := make([]ports.IP, len(e.Subnets))
	for i, subn := range e.Subnets {
		fixedIPs[i] = ports.IP{
			SubnetID: fi.ValueOf(subn.ID),
		}
	}

	return ports.CreateOpts{
		Name:                fi.ValueOf(e.Name),
		NetworkID:           fi.ValueOf(e.Network.ID),
		SecurityGroups:      &sgs,
		FixedIPs:            fixedIPs,
		AllowedAddressPairs: e.AllowedAddressPairs,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the group name in the error against `openstack security group list` in the target project
2. Create the missing security group or correct the name in the cluster spec
3. Ensure kops is pointed at the same Openstack project where the group exists
4. Re-run kops after the fix

Example fix

// before (cluster.yaml)
additionalSecurityGroups:
- sg-loadbalancers
// after
additionalSecurityGroups:
- loadbalancers-sg  # name exactly as it exists in the project

for _, sgName := range additionalSecurityGroups {
    gs, err := cloud.ListSecurityGroups(securitygroups.ListOpts{Name: sgName})
    if err != nil {
        return fmt.Errorf("cannot list security groups: %v", err)
    }
    if len(gs) == 0 {
        return fmt.Errorf("Additional SecurityGroup not found for name %s", sgName)
    }
}

gs, err := t.Cloud.ListSecurityGroups(opt)
if err != nil {
    continue // NOTE: current code swallows list errors; handle explicitly in your own wrapper
}
if len(gs) == 0 {
    return nil, fmt.Errorf("Additional SecurityGroup not found for name %s", sg)
}

When it happens

Trigger: e.SecurityGroups (additional security groups beyond the default ones) contains a name for which ListSecurityGroups returns an empty result while building ports.CreateOpts.

Common situations: Typo in a security group name in the cluster spec; security group created in another project/region; security group deleted out-of-band; cluster spec referencing AWS-style group names on Openstack.

Related errors

• error describing Network: %v
• network %q not found
• error building neutron client: %w
• could not establish floating network id
• error listing subnets in network %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/379e386ddfaf68cd. Report an issue: GitHub.