kubernetes/kops · error

error creating server group: %v

Error message

error creating server group: %v

What it means

createServerGroup wraps the Gophercloud servergroups.Create call (Nova compute API POST /os-server-groups). If the OpenStack API rejects the create or the HTTP request fails, the underlying Gophercloud error is wrapped as "error creating server group: %v" and returned after the retry backoff is exhausted or immediately on a non-retryable failure. It means kOps could not create the anti-affinity/affinity server group needed to place instance-group members.

Source

Thrown at upup/pkg/fi/cloudup/openstack/server_group.go:45

	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/klog/v2"
	"k8s.io/kops/pkg/apis/kops"
	"k8s.io/kops/pkg/cloudinstances"
	"k8s.io/kops/upup/pkg/fi"
	"k8s.io/kops/util/pkg/vfs"
)

func (c *openstackCloud) CreateServerGroup(opt servergroups.CreateOptsBuilder) (*servergroups.ServerGroup, error) {
	return createServerGroup(c, opt)
}

func createServerGroup(c OpenstackCloud, opt servergroups.CreateOptsBuilder) (*servergroups.ServerGroup, error) {
	var i *servergroups.ServerGroup

	done, err := vfs.RetryWithBackoff(writeBackoff, func() (bool, error) {
		v, err := servergroups.Create(context.TODO(), c.ComputeClient(), opt).Extract()
		if err != nil {
			return false, fmt.Errorf("error creating server group: %v", err)
		}
		i = v
		return true, nil
	})
	if err != nil {
		return i, err
	} else if done {
		return i, nil
	} else {
		return i, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) ListServerGroups(opts servergroups.ListOptsBuilder) ([]servergroups.ServerGroup, error) {
	return listServerGroups(c, opts)
}

func listServerGroups(c OpenstackCloud, opts servergroups.ListOptsBuilder) ([]servergroups.ServerGroup, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials and endpoint: run 'openstack server group list' with the same OS_* environment to confirm auth and that the compute API is reachable.
2. Confirm the server group policy (e.g. anti-affinity) is supported/enabled by the cloud's Nova deployment; adjust Cluster.Spec topology or the policy value if not.
3. Check the project's server-group quota ('openstack quota show') and request an increase or delete unused server groups.
4. Inspect the wrapped Gophercloud error for HTTP status: 401/403 -> re-authenticate/fix roles; 404 -> fix region/interface in the provider config; 409 -> resolve quota/conflict.
5. Re-run after transient nova-api failures; the internal vfs.RetryWithBackoff already retries, so persistent errors are real config/API problems.

Example fix

// before: policy not supported by cloud
opt := servergroups.CreateOpts{Name: name, Policies: []string{"anti-affinity"}}
// after: fall back to soft policy the cloud supports
policies := []string{"anti-affinity"}
if cloudDoesNotSupportStrictAntiAffinity {
	policies = []string{"soft-anti-affinity"}
}
opt := servergroups.CreateOpts{Name: name, Policies: policies}

// Before creating, verify auth, endpoint and quota
out, err := exec.Command("openstack", "server", "group", "list").CombinedOutput()
if err != nil {
	return fmt.Errorf("openstack compute API not usable with current credentials: %s: %w", out, err)
}

sg, err := cloud.CreateServerGroup(opt)
if err != nil {
	var gerr gophercloud.ErrUnexpectedResponseCode
	if errors.As(err, &gerr) {
		switch gerr.Actual {
		case 401, 403:
			return fmt.Errorf("auth/permission problem creating server group: %w", err) // fix credentials/roles
		case 409:
			return fmt.Errorf("server group quota or conflict: %w", err) // raise quota, delete unused groups
		}
	}
	if errors.Is(err, wait.ErrWaitTimeout) {
		return fmt.Errorf("server group creation timed out after retries: %w", err)
	}
	return err
}

When it happens

Trigger: servergroups.Create(c.ComputeClient(), opt) returns an error: invalid or unsupported policy in CreateOpts (e.g. 'anti-affinity' policy not enabled by the Nova policy), a 401/403 from expired or insufficient-scope Keystone credentials, a 404 because the compute service/endpoint is missing in the catalog, a 409 quota or conflict response, or a network failure contacting the compute endpoint.

Common situations: Wrong OS_* environment variables or stale Keystone token; cloud admin disabled the server-group policy; tenant hit its server-group quota; kOps cluster config references a compute microversion or region lacking the server-groups extension; temporary nova-api outage or LB timeout between kOps and OpenStack.

Related errors

• error listing server groups: %v
• error deleting server group: %v
• error creating ServerGroup: %v
• Error creating keypair: %v
• error building nova client: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6223e47e0f0afc0d. Report an issue: GitHub.