kubernetes/kops · error

error creating LB listener: %v

Error message

error creating LB listener: %v

What it means

kOps' LBListener RenderOpenstack task wraps any failure from the Octavia listener-create API (listeners.Create via t.Cloud.CreateListener). The wrapped error comes from the Openstack Octavia API (auth, quota, validation, port conflicts, etc.). It indicates the listener could not be created for the load balancer backing a Kubernetes API NLB.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/lblistener.go:167

	}

	if a == nil {
		klog.V(2).Infof("Creating LB with Name: %q", fi.ValueOf(e.Name))
		listeneropts := listeners.CreateOpts{
			Name:           fi.ValueOf(e.Name),
			DefaultPoolID:  fi.ValueOf(e.Pool.ID),
			LoadbalancerID: fi.ValueOf(e.Pool.Loadbalancer.ID),
			Protocol:       listeners.ProtocolTCP,
			ProtocolPort:   fi.ValueOf(e.Port),
		}

		if useVIPACL && (fi.ValueOf(e.Pool.Loadbalancer.Provider) != "ovn") {
			listeneropts.AllowedCIDRs = e.AllowedCIDRs
		}

		listener, err := t.Cloud.CreateListener(listeneropts)
		if err != nil {
			return fmt.Errorf("error creating LB listener: %v", err)
		}
		e.ID = new(listener.ID)
		return nil
	} else if len(changes.AllowedCIDRs) > 0 {
		if useVIPACL && (fi.ValueOf(a.Pool.Loadbalancer.Provider) != "ovn") {
			opts := listeners.UpdateOpts{
				AllowedCIDRs: &changes.AllowedCIDRs,
			}
			_, err := listeners.Update(context.TODO(), t.Cloud.LoadBalancerClient(), fi.ValueOf(a.ID), opts).Extract()
			if err != nil {
				return fmt.Errorf("error updating LB listener: %v", err)
			}
		} else {
			klog.V(2).Infof("Openstack Octavia VIPACLs not supported")
		}
		return nil
	}
	klog.V(2).Infof("Openstack task LB::RenderOpenstack did nothing")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v error: it contains the Octavia API status/body; fix the underlying cause (quota, state, validation).
2. Check project LB quotas: openstack quota show --load-balancer; raise listener quota if 'quota exceeded'.
3. Ensure the load balancer is ACTIVE (openstack loadbalancer show <lb-id>) before re-running kops; wait for pending operations to finish.
4. Verify octavia provider compatibility (ovn only supports certain listener configs); adjust cluster spec or wait/retry the kops update.

Example fix

// before: listener created before LB ACTIVE
pool, err := t.Cloud.CreatePool(...) // LB still PENDING_ACTIVE
listener, err := t.Cloud.CreateListener(listeneropts)
// after: wait for ACTIVE status first
if err := waitLoadbalancerActiveProvisioningStatus(t.Cloud.LoadBalancerClient(), fi.ValueOf(e.Pool.Loadbalancer.ID)); err != nil {
	return err
}
listener, err := t.Cloud.CreateListener(listeneropts)

// before invoking kops update, ensure the Octavia LB is ACTIVE and quotas allow a new listener
lb := openstackLoadbalancerShow(lbID)
if lb.ProvisioningStatus != "ACTIVE" { return fmt.Errorf("LB %s is %s; wait before creating listener", lbID, lb.ProvisioningStatus) }
if listenersUsed >= listenerQuota { return fmt.Errorf("listener quota exhausted for project") }

if err := kopsUpdate(); err != nil {
	var apiErr gophercloud.ErrUnexpectedResponseCode
	if errors.As(err, &apiErr) && apiErr.StatusCode == 409 {
		// LB not ACTIVE: back off and retry
		time.Sleep(30 * time.Second); retry()
	}
	return fmt.Errorf("listener creation failed: %w", err)
}

When it happens

Trigger: Rendering a new LBListener (a == nil) when the Octavia POST /v2/lbaas/listeners call fails: e.g. loadbalancer not in ACTIVE state, invalid protocol/port, listener quota exhausted, project quota exceeded, or transient 4xx/5xx from Octavia.

Common situations: Cluster create/update on OpenStack where the load balancer service quota (listeners per project) is exhausted; the LB is still PENDING_* from a prior operation; octavia provider (e.g. ovn) rejects TCP listener on the chosen port; stale/expired OpenStack credentials.

Related errors

• error deleting loadbalancer: %v
• error creating loadbalancer: %v
• failed to list loadbalancers: %s
• failed to list members: %v
• failed to list pools: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/06443e157950b331. Report an issue: GitHub.