kubernetes/kops · error

Error creating network: %v

Error message

Error creating network: %v

What it means

kOps wraps the gophercloud error returned by OpenstackCloud.CreateNetwork when rendering the Openstack Network task (RenderOpenstack). It means the Neutron API rejected or failed the network-create call, so the desired cluster network could not be provisioned. The wrapper preserves the underlying Neutron/gophercloud error text after the prefix.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/network.go:129

	if a == nil || changes.Tag != nil {
		return true, nil
	}
	return false, nil
}

func (_ *Network) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *Network) error {
	if a == nil {
		klog.V(2).Infof("Creating Network with name:%q", fi.ValueOf(e.Name))

		opt := networks.CreateOpts{
			Name:                  fi.ValueOf(e.Name),
			AdminStateUp:          new(true),
			AvailabilityZoneHints: fi.StringSliceValue(e.AvailabilityZoneHints),
		}

		v, err := t.Cloud.CreateNetwork(opt)
		if err != nil {
			return fmt.Errorf("Error creating network: %v", err)
		}

		err = t.Cloud.AppendTag(openstack.ResourceTypeNetwork, v.ID, fi.ValueOf(e.Tag))
		if err != nil {
			return fmt.Errorf("Error appending tag to network: %v", err)
		}

		e.ID = new(v.ID)
		klog.V(2).Infof("Creating a new Openstack network, id=%s", v.ID)
		return nil
	} else {
		err := t.Cloud.AppendTag(openstack.ResourceTypeNetwork, fi.ValueOf(a.ID), fi.ValueOf(changes.Tag))
		if err != nil {
			return fmt.Errorf("Error appending tag to network: %v", err)
		}
	}
	e.ID = a.ID
	klog.V(2).Infof("Using an existing Openstack network, id=%s", fi.ValueOf(e.ID))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v message from gophercloud to identify the Neutron 4xx/5xx status
2. Check Neutron network quota (openstack quota show) and delete unused networks or raise the quota
3. Validate AvailabilityZoneHints against `openstack network availability zone list` and correct the cluster spec
4. Re-authenticate: verify OS_* environment variables / clouds.yaml credentials and project scope
5. Confirm Neutron service is healthy in the service catalog and reachable from the kops host

Example fix

// before
AvailabilityZoneHints: fi.StringSliceValue([]string{"nova-unknown-zone"})
// after
AvailabilityZoneHints: fi.StringSliceValue([]string{"nova"}) // must exist in `openstack network availability zone list`

// pre-flight
cmd := exec.Command("openstack", "quota", "show", "--networks")
out, err := cmd.Output() // verify network quota > 0
if err != nil { return err }
azOut, _ := exec.Command("openstack", "network", "availability", "zone", "list").Output()
// ensure spec AZ hints appear in azOut before running kops update

func isNeutronQuotaError(err error) bool {
	return err != nil && strings.Contains(err.Error(), "Quota exceeded")
}

v, err := t.Cloud.CreateNetwork(opt)
if err != nil {
	if isNeutronQuotaError(err) {
		// raise quota or free networks, then retry
	}
	return fmt.Errorf("Error creating network: %v", err)
}

When it happens

Trigger: t.Cloud.CreateNetwork(opt) returns an error during `kops update cluster` on OpenStack: invalid network name, missing/insufficient Neutron quota (e.g. quota exceeded for networks), bad AvailabilityZoneHints referencing a nonexistent AZ, expired or unauthorized Keystone token, or Neutron endpoint unreachable.

Common situations: Tenant hit its networks quota; cloud config (os-client-config/clouds.yaml) points at a wrong project; router/network extensions (e.g. availability zone hints) unsupported by the deployed Neutron version; network name conflicts with existing resources in a different project.

Related errors

• error describing Network: %v
• network %q not found
• error retrieving network with id %s: %v
• error listing networks: %v
• error extracting networks from pages: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/38bc424220664f09. Report an issue: GitHub.