kubernetes/kops · error

error creating SecurityGroup: %v

Error message

error creating SecurityGroup: %v

What it means

This error is returned by SecurityGroup.RenderOpenstack when the OpenstackAPITarget's call to Cloud.CreateSecurityGroup fails while provisioning a new Neutron security group during a kOps cluster apply. It wraps the underlying gophercloud/Neutron error (e.g. auth failure, quota exceeded, name conflict, network service unavailable). The formatted message always reads "error creating SecurityGroup: <underlying error>" and aborts the render of the security group task.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:123

		if changes.Name != nil {
			return fi.CannotChangeField("Name")
		}
	}
	return nil
}

func (_ *SecurityGroup) RenderOpenstack(t *openstack.OpenstackAPITarget, a, e, changes *SecurityGroup) error {
	if a == nil {
		klog.V(2).Infof("Creating SecurityGroup with Name:%q", fi.ValueOf(e.Name))

		opt := sg.CreateOpts{
			Name:        fi.ValueOf(e.Name),
			Description: fi.ValueOf(e.Description),
		}

		g, err := t.Cloud.CreateSecurityGroup(opt)
		if err != nil {
			return fmt.Errorf("error creating SecurityGroup: %v", err)
		}

		e.ID = new(g.ID)
		return nil
	}

	klog.V(2).Infof("Openstack task SecurityGroup::RenderOpenstack did nothing")
	return nil
}

func (s *SecurityGroup) FindDeletions(c *fi.CloudupContext) ([]fi.CloudupDeletion, error) {
	var removals []fi.CloudupDeletion

	if len(s.RemoveExtraRules) == 0 && !s.RemoveGroup {
		return nil, nil
	}

	cloud := c.T.Cloud.(openstack.OpenstackCloud)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped '%v' detail to identify the underlying Neutron error (401 auth, 409 conflict, 403 quota).
2. If quota exceeded (403 with quota message), delete unused security groups in the project or ask the cloud admin to raise the quota.
3. If a duplicate group name exists, remove the stale group or reuse it (ensure the task's Find/getSecurityGroupByName can locate exactly one).
4. Verify credentials and region (openstack token issue / openstack catalog list) and re-run kops update.
5. Check Neutron service health/endpoint; retry the apply once the API is reachable.

Example fix

// before: apply fails with opaque quota error
kops update cluster --name mycluster
// error creating SecurityGroup: Request forbidden: Maximum number of security groups exceeded
// after: raise or free quota, then retry
openstack security group list  # find unused groups
openstack security group delete <stale-id>
kops update cluster --name mycluster --yes

// before apply: verify auth and group quota/name
sess, _ := openstack.AuthenticatedClient(provider)
neutron, _ := openstack.NewNetworkV2(provider, eo)
page, _ := groups.List(neutron, groups.ListOpts{Name: name}).AllPages()
list, _ := groups.ExtractGroups(page)
if len(list) > 0 { // group already exists; task will update instead of create
}

func isOpenstackQuotaErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "quota")
}

err := target.Cloud.CreateSecurityGroup(opt)
if err != nil {
	if strings.Contains(err.Error(), "401") || strings.Contains(err.Error(), "authentication") {
		// re-authenticate and retry
	} else if strings.Contains(err.Error(), "quota") {
		// free up or request higher security group quota
	}
	return fmt.Errorf("error creating SecurityGroup: %w", err)
}

When it happens

Trigger: RenderOpenstack with a==nil (the group does not yet exist) calls t.Cloud.CreateSecurityGroup(sg.CreateOpts{Name, Description}); any non-nil error from the Neutron POST /security_groups API is wrapped here. Typical causes: Keystone auth expired, Neutron quota (security_groups) exceeded, duplicate group name in the project when Neutron rejects it, or Neutron endpoint down/404.

Common situations: Clusters where the OpenStack project hit its security-group quota; misconfigured OS_* environment credentials causing 401; a stale group with the same name left from a failed previous run; Neutron outage or wrong --os-region / endpoint config.

Related errors

• error listing security group rules %v: %v
• error extracting security group rules from pages: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cb875a5d59b6724f. Report an issue: GitHub.