kubernetes/kops · error

cannot revoke ingress for ID %q with rule IDs %v: %v

Error message

cannot revoke ingress for ID %q with rule IDs %v: %v

What it means

In DeleteSecurityGroup (pkg/resources/aws/securitygroup.go:88), the enumerated ingress rule IDs are revoked via RevokeSecurityGroupIngress before deleting the group. This error wraps the revoke failure and includes the group ID and the specific rule IDs attempted. It means the SG's ingress rules could not be cleared, blocking subsequent deletion of inter-dependent groups.

Source

Thrown at pkg/resources/aws/securitygroup.go:88

			}
			return fmt.Errorf("error describing SecurityGroup rules %q: %v", id, err)
		}

		ingressRuleIDs := make([]string, 0)
		for _, rule := range ruleResp.SecurityGroupRules {
			if !aws.ToBool(rule.IsEgress) {
				ingressRuleIDs = append(ingressRuleIDs, aws.ToString(rule.SecurityGroupRuleId))
			}
		}

		if len(ingressRuleIDs) != 0 {
			revoke := &ec2.RevokeSecurityGroupIngressInput{
				GroupId:              aws.String(id),
				SecurityGroupRuleIds: ingressRuleIDs,
			}
			_, err = c.EC2().RevokeSecurityGroupIngress(ctx, revoke)
			if err != nil {
				return fmt.Errorf("cannot revoke ingress for ID %q with rule IDs %v: %v", id, ingressRuleIDs, err)
			}
		}
	}

	{
		klog.V(2).Infof("Deleting EC2 SecurityGroup %q", id)
		request := &ec2.DeleteSecurityGroupInput{
			GroupId: &id,
		}
		_, err := c.EC2().DeleteSecurityGroup(ctx, request)
		if err != nil {
			if IsDependencyViolation(err) {
				return err
			}
			return fmt.Errorf("error deleting SecurityGroup %q: %v", id, err)
		}
	}
	return nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-describe the SG's rules and retry the revoke with fresh rule IDs (stale-ID race).
2. Grant ec2:RevokeSecurityGroupIngress in the IAM policy.
3. If rules/group are already gone, treat as success and proceed to DeleteSecurityGroup.
4. Retry on throttling; serialize deletion of interdependent security groups.

Example fix

// before
_, err = c.EC2().RevokeSecurityGroupIngress(ctx, revoke)
if err != nil {
    return fmt.Errorf("cannot revoke ingress for ID %q with rule IDs %v: %v", id, ingressRuleIDs, err)
}
// after
_, err = c.EC2().RevokeSecurityGroupIngress(ctx, revoke)
if err != nil {
    code := awsup.AWSErrorCode(err)
    if code == "InvalidGroup.NotFound" || code == "InvalidPermission.NotFound" {
        klog.V(2).Infof("Ingress rules for %q already revoked", id)
    } else {
        return fmt.Errorf("cannot revoke ingress for ID %q with rule IDs %v: %w", id, ingressRuleIDs, err)
    }
}

// refresh rule IDs immediately before revoking
desc, err := ec2Client.DescribeSecurityGroupRules(ctx, &ec2.DescribeSecurityGroupRulesInput{
    Filters: []ec2types.Filter{{Name: aws.String("group-id"), Values: []string{id}}},
})
if err != nil { return err }
if len(desc.SecurityGroupRules) == 0 { return nil } // nothing to revoke

func isRevocableRace(err error) bool {
    c := awsup.AWSErrorCode(err)
    return c == "InvalidGroup.NotFound" || c == "InvalidPermission.NotFound" || c == "InvalidRule.NotFound"
}

_, err := ec2Client.RevokeSecurityGroupIngress(ctx, revoke)
if err != nil {
    if isRevocableRace(err) { return nil } // already gone
    if isThrottling(err) { /* retry with backoff */ }
    return fmt.Errorf("cannot revoke ingress for %q: %w", id, err)
}

When it happens

Trigger: RevokeSecurityGroupIngress with GroupId + SecurityGroupRuleIds failing: InvalidGroup.NotFound (group/rule vanished concurrently), InvalidPermission.NotFound (rule already removed), UnauthorizedOperation (missing ec2:RevokeSecurityGroupIngress), throttling, or stale rule IDs from a prior describe.

Common situations: Concurrent deletion (another kops run or controller removing rules) causing stale rule IDs; IAM missing RevokeSecurityGroupIngress; default-VPC groups referenced by other groups causing dependency errors during parallel teardown.

Related errors

• error creating SecurityGroupIngress: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v
• error deleting SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/00c78432b22d6ca7. Report an issue: GitHub.