kubernetes/kops · error

error creating SecurityGroupRule in SG %s: %v

Error message

error creating SecurityGroupRule in SG %s: %v

What it means

Creating a security-group rule via the Neutron API failed during apply. The wrapped error identifies the rejection, commonly invalid CIDR, port range, duplicate rule, or quota issues.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygrouprule.go:178

				etherType = "IPv6"
			}
		}
		opt := sgr.CreateOpts{
			Direction:      sgr.RuleDirection(fi.ValueOf(e.Direction)),
			EtherType:      sgr.RuleEtherType(etherType),
			SecGroupID:     fi.ValueOf(e.SecGroup.ID),
			PortRangeMax:   IntValue(e.PortRangeMax),
			PortRangeMin:   IntValue(e.PortRangeMin),
			Protocol:       sgr.RuleProtocol(fi.ValueOf(e.Protocol)),
			RemoteIPPrefix: fi.ValueOf(e.RemoteIPPrefix),
		}
		if e.RemoteGroup != nil {
			opt.RemoteGroupID = fi.ValueOf(e.RemoteGroup.ID)
		}

		r, err := t.Cloud.CreateSecurityGroupRule(opt)
		if err != nil {
			return fmt.Errorf("error creating SecurityGroupRule in SG %s: %v", fi.ValueOf(e.SecGroup.GetName()), err)
		}

		e.ID = new(r.ID)
		return nil
	}

	klog.V(2).Infof("Openstack task SecurityGroupRule::RenderOpenstack did nothing")
	return nil
}

var _ fi.HasLifecycle = (*SecurityGroupRule)(nil)

// GetLifecycle returns the Lifecycle of the object, implementing fi.HasLifecycle
func (o *SecurityGroupRule) GetLifecycle() fi.Lifecycle {
	return o.Lifecycle
}

// SetLifecycle sets the Lifecycle of the object, implementing fi.SetLifecycle

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error for the rejected field
2. Validate CIDR, protocol and port range values
3. Remove conflicting duplicate rules and retry

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygrouprule.go:178 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8edcff3c7f6d8f08. Report an issue: GitHub.