kubernetes/kops · error

error creating port

Error message

error creating port: %v

What it means

createPort (upup/pkg/fi/cloudup/openstack/port.go:38) calls the Neutron port-create API inside a retry loop (writeBackoff). If ports.Create(...).Extract() returns an error, it is wrapped with this message and retried until writeBackoff is exhausted.

Solutions

1. Read the wrapped Neutron error for the specific status; fix the referenced resource (network ID, subnet, security group) accordingly.
2. Free or expand the subnet IP pool if the failure is 'no more IP addresses available'.
3. Verify credentials/project scope allow port creation on the target network.
4. Re-run the operation; writeBackoff retries transient errors, so later attempts may succeed.

Example fix

// before
port, err := ports.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
if err != nil {
    return false, fmt.Errorf("error creating port: %v", err)
}
// after — pre-check subnet capacity to fail fast with a clearer message
if err := ensureSubnetHasFreeIPs(c, opt); err != nil {
    return false, err
}
port, err := ports.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
if err != nil {
    return false, fmt.Errorf("error creating port: %v", err)
}

// Validate referenced resources before creating the port
if networkID == "" || subnetID == "" {
    return errors.New("network and subnet IDs are required to create a port")
}
network, err := getNetwork(c, networkID)
if err != nil {
    return fmt.Errorf("network %s not found/accessible: %w", networkID, err)
}
sgs, _ := listSecurityGroups(c, securitygroups.ListOpts{ID: securityGroupID})
if len(sgs) == 0 {
    return fmt.Errorf("security group %s does not exist", securityGroupID)
}

port, err := createPort(c, opts)
if err != nil {
    if strings.Contains(err.Error(), "No more IP addresses") || strings.Contains(err.Error(), "400") {
        // subnet exhausted — expand the allocation pool, then retry
    }
    return fmt.Errorf("port creation failed: %w", err)
}

When it happens

Trigger: ports.Create with the given CreateOptsBuilder fails persistently — invalid network_id or fixed_ips, subnet exhaustion (no free IPs → 400), security-group ID does not exist, 409 conflict, or 401/403 credentials issues on every attempt.

Common situations: Provisioning instances/LBs on a subnet whose IP pool is exhausted; referencing a security group deleted out-of-band; using a network ID from another project; transient Neutron outages that outlast the backoff window.

Related errors

• Error appending tag to network
• Error creating network
• error creating network
• error describing Network
• error extracting networks from pages

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/69796fbbcdfdfadf. Report an issue: GitHub.

Appendix: source

Thrown at upup/pkg/fi/cloudup/openstack/port.go:38

	"context"
	"fmt"

	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/ports"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/kops/util/pkg/vfs"
)

func (c *openstackCloud) CreatePort(opt ports.CreateOptsBuilder) (*ports.Port, error) {
	return createPort(c, opt)
}

func createPort(c OpenstackCloud, opt ports.CreateOptsBuilder) (*ports.Port, error) {
	var p *ports.Port

	done, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {
		port, err := ports.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
		if err != nil {
			return false, fmt.Errorf("error creating port: %v", err)
		}
		p = port
		return true, nil
	})
	if err != nil {
		return p, err
	} else if done {
		return p, nil
	} else {
		return p, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) UpdatePort(id string, opt ports.UpdateOptsBuilder) (*ports.Port, error) {
	return updatePort(c, id, opt)
}

func updatePort(c OpenstackCloud, id string, opt ports.UpdateOptsBuilder) (*ports.Port, error) {

View on GitHub (pinned to 4c8573c808)