kubernetes/kops · error

Error creating port cloud opts: %v

Error message

Error creating port cloud opts: %v

What it means

Port.RenderOpenstack wraps failures from portCreateOptsFromPortTask — the function that converts the Port task into Neutron ports.CreateOpts — with this message. It means the task model itself was invalid for translation to a cloud request (e.g. referenced security group or subnet lookup failed inside the opts builder), not that the API call failed.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/port.go:256

		}
	} else {
		if changes.Name != nil {
			return fi.CannotChangeField("Name")
		}
		if changes.Network != nil {
			return fi.CannotChangeField("Network")
		}
	}
	return nil
}

func (*Port) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *Port) error {
	if a == nil {
		klog.V(2).Infof("Creating Port with name: %q", fi.ValueOf(e.Name))

		opt, err := portCreateOptsFromPortTask(t, a, e, changes)
		if err != nil {
			return fmt.Errorf("Error creating port cloud opts: %v", err)
		}

		v, err := t.Cloud.CreatePort(opt)
		if err != nil {
			return fmt.Errorf("Error creating port: %v", err)
		}

		if e.Tags != nil {
			for _, tag := range e.Tags {
				err = t.Cloud.AppendTag(openstack.ResourceTypePort, v.ID, tag)
				if err != nil {
					return fmt.Errorf("Error appending tag to port: %v", err)
				}
			}
		}
		e.ID = new(v.ID)
		klog.V(2).Infof("Creating a new Openstack port, id=%s", v.ID)
		return nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the inner error: it usually names the missing security group
2. Create the referenced security group in the Openstack project or fix its name in the cluster spec
3. Verify the security groups exist via `openstack security group list`
4. Re-run kops once the spec references existing groups

Example fix

null

for _, sg := range port.SecurityGroups {
    gs, err := cloud.ListSecurityGroups(securitygroups.ListOpts{Name: sg})
    if err != nil || len(gs) == 0 {
        return fmt.Errorf("security group %q not found; fix cluster spec before apply", sg)
    }
}

opt, err := portCreateOptsFromPortTask(t, a, e, changes)
if err != nil {
    return fmt.Errorf("Error creating port cloud opts: %v", err)
} // inspect inner error; usually a missing named security group

When it happens

Trigger: RenderOpenstack with a==nil (create path) calls portCreateOptsFromPortTask, which returns an error — typically because a named security group listed in e.SecurityGroups could not be found (see portCreateOptsFromPortTask returning 'Additional SecurityGroup not found').

Common situations: Cluster spec references additional security groups by name that don't exist in the project; security groups belong to a different project; subnet references unresolvable at render time.

Related errors

• failed to find floating ip: %v
• failed to list layer 3 floating ips for port ID %s: %v
• Failed to get port with id %s: %v
• found multiple ports with name: %s
• Error creating port: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/016466c932b471c5. Report an issue: GitHub.