kubernetes/kops · error

cannot parse rule %q

Error message

cannot parse rule %q

What it means

The internal removal-rule DSL could not parse the given rule string. Currently only 'port=N' is supported; the rule's port value failed integer conversion or the syntax is unrecognized, so the rule cannot be matched against cloud rules.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:328

type RemovalRule interface {
	Matches(sgr.SecGroupRule) bool
}

// ParseRemovalRule parses our removal rule DSL into a RemovalRule
func ParseRemovalRule(rule string) (RemovalRule, error) {
	rule = strings.TrimSpace(rule)
	tokens := strings.Split(rule, "=")

	// Simple little language:
	//   port=N matches rules that filter (only) by port=N
	//
	// Note this language is internal, so isn't required to be stable

	if len(tokens) == 2 {
		if tokens[0] == "port" {
			port, err := strconv.Atoi(tokens[1])
			if err != nil {
				return nil, fmt.Errorf("cannot parse rule %q", rule)
			}

			return &PortRemovalRule{Port: port}, nil
		} else {
			return nil, fmt.Errorf("cannot parse rule %q", rule)
		}
	}
	return nil, fmt.Errorf("cannot parse rule %q", rule)
}

type PortRemovalRule struct {
	Port int
}

var _ RemovalRule = (*PortRemovalRule)(nil)

func (r *PortRemovalRule) String() string {
	return fi.DebugAsJsonString(r)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Use the supported 'port=<number>' syntax
2. Remove the invalid rule from the security group's removal rules list

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:328 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/43e51fd5391707d2. Report an issue: GitHub.