kubernetes/kops · error

error creating security group rule %v: %v

Error message

error creating security group rule %v: %v

What it means

This error is returned by createSecurityGroupRule when the Neutron security-group-rule Create API call returns an error inside the writeBackoff retry loop. It wraps the gophercloud error together with the CreateOptsBuilder, so the failing rule parameters (direction, protocol, port range, remote group/CIDR) are included in the message. Common underlying causes are 409 conflicts (duplicate rule) and 400 validation errors.

Source

Thrown at upup/pkg/fi/cloudup/openstack/security_group.go:121

		return rules, err
	} else if done {
		return rules, nil
	} else {
		return rules, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) CreateSecurityGroupRule(opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {
	return createSecurityGroupRule(c, opt)
}

func createSecurityGroupRule(c OpenstackCloud, opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {
	var rule *sgr.SecGroupRule

	done, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {
		r, err := sgr.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
		if err != nil {
			return false, fmt.Errorf("error creating security group rule %v: %v", opt, err)
		}
		rule = r
		return true, nil
	})
	if err != nil {
		return rule, err
	} else if done {
		return rule, nil
	} else {
		return rule, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) DeleteSecurityGroup(sgID string) error {
	return deleteSecurityGroup(c, sgID)
}

func deleteSecurityGroup(c OpenstackCloud, sgID string) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped HTTP status: on 409 the rule already exists — treat as success or delete the duplicate first
2. Validate the CreateOpts (port_range_min <= port_range_max, valid protocol, existing remote group ID) before calling
3. Check rule quota with `openstack quota show` and raise limits if exceeded
4. Re-apply after fixing; writeBackoff retries transient failures already

Example fix

// before: blindly create and fail on duplicates
r, err := sgr.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
// after: tolerate already-existing rule
r, err := sgr.Create(context.TODO(), c.NetworkingClient(), opt).Extract()
if err != nil {
	if _, ok := err.(gophercloud.ErrDefault409); ok {
		return true, nil // rule already exists
	}
	return false, fmt.Errorf("error creating security group rule %v: %v", opt, err)
}

func validateRuleOpts(opt sgr.CreateOpts) error {
	if opt.PortRangeMin > opt.PortRangeMax {
		return fmt.Errorf("port_range_min %d > port_range_max %d", opt.PortRangeMin, opt.PortRangeMax)
	}
	if opt.Protocol != "tcp" && opt.Protocol != "udp" && opt.Protocol != "icmp" {
		return fmt.Errorf("invalid protocol %q", opt.Protocol)
	}
	if opt.RemoteGroupID == "" && opt.RemoteIPPrefix == "" {
		return fmt.Errorf("rule needs RemoteGroupID or RemoteIPPrefix")
	}
	return nil
}

func isDuplicateRuleErr(err error) bool {
	var conflict gophercloud.ErrDefault409
	return errors.As(err, &conflict)
}

rule, err := createSecurityGroupRule(c, opt)
if err != nil {
	if isDuplicateRuleErr(err) {
		return existingRule, nil // idempotent apply: rule already present
	}
	return fmt.Errorf("creating rule: %w", err)
}

When it happens

Trigger: sgr.Create(context.TODO(), c.NetworkingClient(), opt).Extract() fails: the identical rule already exists (HTTP 409), invalid port range (e.g. port_range_max < min), invalid protocol, quota exceeded for security group rules, or a non-existent remote security group/CIDR is referenced.

Common situations: Repeated kops apply runs colliding with previously created identical rules (409 duplicate), cluster spec with invalid port ranges, project hitting Neutron quota limits, or referencing a deleted security group as the remote group.

Related errors

• error listing security group rules %v: %v
• error extracting security group rules from pages: %v
• error deleting security group: %v
• error deleting security group rule: %v
• Failed to update security group for port %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/894e8048b4f77c45. Report an issue: GitHub.