kubernetes/kops · error

cannot parse rule %q: %v

Error message

cannot parse rule %q: %v

What it means

FindDeletions parses each entry of the SecurityGroup task's RemoveExtraRules list with ParseRemovalRule; this error is returned when a rule string does not conform to the internal rule DSL. The only accepted syntax is `port=N` (with exactly one '=' and an integer N); anything else, including a non-integer port, yields "cannot parse rule %q: %v".

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:158

	cloud := c.T.Cloud.(openstack.OpenstackCloud)
	if s.RemoveGroup {
		sg, err := getSecurityGroupByName(s, cloud)
		if err != nil {
			return nil, err
		}
		if sg != nil {
			removals = append(removals, &deleteSecurityGroup{
				securityGroup: sg,
			})
		}
	}

	var rules []RemovalRule
	for _, r := range s.RemoveExtraRules {
		rule, err := ParseRemovalRule(r)
		if err != nil {
			return nil, fmt.Errorf("cannot parse rule %q: %v", r, err)
		}
		rules = append(rules, rule)
	}

	sg, err := getSecurityGroupByName(s, cloud)
	if err != nil {
		return nil, err
	}
	if sg == nil {
		return nil, nil
	}

	sgRules, err := cloud.ListSecurityGroupRules(sgr.ListOpts{
		SecGroupID: fi.ValueOf(sg.ID),
	})
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the %q in the message to see the offending rule string.
2. Rewrite the rule as exactly `port=<integer>`, e.g. "port=443" — the DSL supports only this form.
3. Remove trailing whitespace/units and ensure the key is lowercase `port`.
4. If you intended to remove rules other than by port, remove the entry from RemoveExtraRules instead of guessing syntax (the language is internal and unstable).

Example fix

// before (cluster spec)
removeExtraRules:
  - port=443/tcp
// after
removeExtraRules:
  - port=443

func validRemovalRule(r string) bool {
	r = strings.TrimSpace(r)
	toks := strings.Split(r, "=")
	if len(toks) != 2 || toks[0] != "port" {
		return false
	}
	_, err := strconv.Atoi(toks[1])
	return err == nil
}
// validate each entry of RemoveExtraRules before saving the cluster spec

rule, err := ParseRemovalRule(r)
if err != nil {
	klog.Errorf("skipping invalid RemoveExtraRules entry %q: %v", r, err)
	continue // or fail fast with a clear config-validation error
}

When it happens

Trigger: A RemoveExtraRules entry like "port=abc", "ports=443", "port=", or "tcp=443" is passed; ParseRemovalRule splits on '=' and either finds an unknown key, fails strconv.Atoi, or does not find exactly 2 tokens.

Common situations: Cluster spec typos in the securityGroupOverride / removeExtraRules configuration; copying rules from docs of a different kOps version where the DSL changed; YAML quoting issues turning numbers into strings like "port=443 " with stray whitespace or units ("port=443/tcp").

Related errors

• invalid taint spec: %v
• cannot parse rule %q: %v
• %s is not a valid metadata search order option. Supported op
• error listing security group rules %v: %v
• error extracting security group rules from pages: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6fea5d24312818d1. Report an issue: GitHub.