kubernetes/kops · error

Error creating router: %v

Error message

Error creating router: %v

What it means

Raised in RenderOpenstack (router.go:126) when the Neutron router-create API call (Cloud.CreateRouter) returns an error after the gateway options were successfully assembled. kOps wraps the gophercloud error with this message, so the root cause is always in the wrapped text — quota, auth, or invalid gateway data.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/router.go:126

		opt.GatewayInfo = &routers.GatewayInfo{
			NetworkID: floatingNet.ID,
		}

		routerFloatingSubnet, err := t.Cloud.GetExternalSubnet()
		if err != nil {
			return fmt.Errorf("Failed to find floatingip subnet: %v", err)
		}
		if routerFloatingSubnet != nil {
			opt.GatewayInfo.ExternalFixedIPs = []routers.ExternalFixedIP{
				{
					SubnetID: routerFloatingSubnet.ID,
				},
			}
		}

		v, err := t.Cloud.CreateRouter(opt)
		if err != nil {
			return fmt.Errorf("Error creating router: %v", err)
		}
		e.ID = new(v.ID)
		klog.V(2).Infof("Creating a new Openstack router, id=%s", v.ID)
		return nil
	}
	e.ID = a.ID
	klog.V(2).Infof("Using an existing Openstack router, id=%s", fi.ValueOf(e.ID))
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped inner error; if it's a quota conflict, check `openstack quota show` and delete unused routers or raise the router quota
2. Confirm the external network has router:external=true: `openstack network show <ext-net>`
3. Verify the floating subnet belongs to the same external network used as gateway
4. Re-authenticate / refresh credentials and re-run `kops update cluster`

Example fix

// before
ERROR: Error creating router: Request forbidden: Quota exceeded for resource router
// after
$ openstack quota set --routers 10 <project>   # or delete stale routers
$ kops update cluster <name> --yes

// pre-check router quota and external flag
q, _ := netClient.GetQuota(projectID).Extract()
extNet, _ := networks.Get(netClient, extNetID).Extract()
if q.Router >= q.RouterLimit || !extNet.External { return errors.New("router quota exhausted or network not external") }

func isQuotaError(err error) bool {
    var gerr gophercloud.ErrUnexpectedResponseCode
    return errors.As(err, &gerr) && gerr.Actual == http.StatusConflict
}

err := kopsUpdate(); if err != nil {
    var gerr gophercloud.ErrUnexpectedResponseCode
    if errors.As(err, &gerr) {
        switch gerr.Actual {
        case http.StatusConflict: log.Fatal("router quota exceeded — delete unused routers or raise quota")
        case http.StatusUnauthorized: log.Fatal("re-authenticate OS credentials and retry")
        }
    }
    return err
}

When it happens

Trigger: cloud.CreateRouter(opt) fails during cluster creation: Neutron returns 409/403 (quota exceeded for routers, admin-state or gateway network not external), 401 auth expiry, 400 invalid GatewayInfo (ExternalFixedIPs subnet not on the external network), or a network timeout.

Common situations: Router quota exhausted in the project (most common), external network flagged router:external=false, the floating subnet ID from GetExternalSubnet doesn't belong to the gateway network, expired OpenStack credentials during a long apply, or Neutron service degraded.

Related errors

• error listing security group rules %v: %v
• failed to list layer 3 floating ips for port ID %s: %v
• found multiple routers with name: %s
• Error creating router. Could not list external networks for
• Failed to find floatingip subnet: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b977ef695a37a49e. Report an issue: GitHub.