kubernetes/kops · error
error appending tag %s: %v
Error message
error appending tag %s: %v
What it means
Wraps a failure of the Neutron attributestags.Add call used to attach a tag to a resource (e.g. network, subnet, router, port). The call is retried with backoff; if it keeps failing the wrapped error is returned.
Source
Thrown at upup/pkg/fi/cloudup/openstack/network.go:39
"fmt"
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/attributestags"
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/external"
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/networks"
"github.com/gophercloud/gophercloud/v2/pagination"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/kops/util/pkg/vfs"
)
func (c *openstackCloud) AppendTag(resource string, id string, tag string) error {
return appendTag(c, resource, id, tag)
}
func appendTag(c OpenstackCloud, resource string, id string, tag string) error {
done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
err := attributestags.Add(context.TODO(), c.NetworkingClient(), resource, id, tag).ExtractErr()
if err != nil {
return false, fmt.Errorf("error appending tag %s: %v", tag, err)
}
return true, nil
})
if err != nil {
return err
} else if done {
return nil
} else {
return wait.ErrWaitTimeout
}
}
func (c *openstackCloud) DeleteTag(resource string, id string, tag string) error {
return deleteTag(c, resource, id, tag)
}
func deleteTag(c OpenstackCloud, resource string, id string, tag string) error {
done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {View on GitHub (pinned to 4c8573c808)
Solutions
- Confirm the resource ID and resource type are correct and the resource still exists
- Check credentials/policy allow tag operations on the resource
- Inspect embedded %v for 404/403 to pinpoint cause
- Rely on the built-in backoff retry for transient network errors
Defensive patterns
Strategy: retry
Validate before calling
// ensure resource exists before tagging _, err := osClient.NetworkingV2().Get(resourceID) // appropriate Get per resource type // proceed only if err == nil
Try / catch
if err := appendTag(c, "networks", id, tag); err != nil {
var gerr gophercloud.ErrUnexpectedResponseCode
if errors.As(err, &gerr) && gerr.Actual == 404 {
return nil // resource gone; skip tagging
}
return err
} Prevention
- Confirm resource IDs exist before tagging
- Ensure the project role includes Neutron tag operations
- Watch for token expiry in long-running applies; re-authenticate
- Treat 404 on tag ops as benign during teardown
When it happens
Trigger: NetworkingClient request to add a tag fails: resource ID not found, 403 auth/policy denial, or network outage to the Neutron endpoint.
Common situations: Tagging a port/subnet that was deleted concurrently; project lacking Neutron tag permissions; Keystone token expired; wrong resource type string passed to appendTag.
Related errors
- error deleting tag %s: %v
- Error appending tag to port: %v
- error describing Network: %v
- network %q not found
- error building neutron client: %w
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/b7223efdbb71bea1.
Report an issue: GitHub.