kubernetes/kops · error

deleting network security group: %w

Error message

deleting network security group: %w

What it means

BeginDelete for the network security group failed to start the deletion LRO; fires on authorization failure, a missing NSG, or the NSG still being in use by subnets/NICs.

Source

Thrown at upup/pkg/fi/cloudup/azure/networksecuritygroup.go:78

	pager := c.c.NewListPager(resourceGroupName, nil)
	for pager.More() {
		resp, err := pager.NextPage(ctx)
		if err != nil {
			var respErr *azcore.ResponseError
			if errors.As(err, &respErr) && respErr.ErrorCode == "ResourceGroupNotFound" {
				return nil, nil
			}
			return nil, fmt.Errorf("listing network security groups: %w", err)
		}
		l = append(l, resp.Value...)
	}
	return l, nil
}

func (c *NetworkSecurityGroupsClientImpl) Delete(ctx context.Context, resourceGroupName, NetworkSecurityGroupName string) error {
	future, err := c.c.BeginDelete(ctx, resourceGroupName, NetworkSecurityGroupName, nil)
	if err != nil {
		return fmt.Errorf("deleting network security group: %w", err)
	}
	if _, err = future.PollUntilDone(ctx, nil); err != nil {
		return fmt.Errorf("waiting for network security group deletion completion: %w", err)
	}
	return nil
}

func newNetworkSecurityGroupsClientImpl(subscriptionID string, cred *azidentity.DefaultAzureCredential) (*NetworkSecurityGroupsClientImpl, error) {
	c, err := network.NewSecurityGroupsClient(subscriptionID, cred, nil)
	if err != nil {
		return nil, fmt.Errorf("creating network security groups client: %w", err)
	}
	return &NetworkSecurityGroupsClientImpl{
		c: c,
	}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Detach subnets/NICs still using the NSG and retry
2. Check the wrapped error code; NotFound means already deleted
3. Verify delete permissions

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azure/networksecuritygroup.go:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b3d1d12f6a3448e8. Report an issue: GitHub.