What causes "error deleting tag %s: %v" in kubernetes/kops?

error deleting tag %s: %v

Error message

error deleting tag %s: %v

What it means

The Neutron attribute-tags delete call for the given tag failed. The call is retried with backoff; failure means the tag could not be removed from the resource, e.g. authorization, resource state, or API problems.

Source

Thrown at upup/pkg/fi/cloudup/openstack/network.go:60

	})
	if err != nil {
		return err
	} else if done {
		return nil
	} else {
		return wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) DeleteTag(resource string, id string, tag string) error {
	return deleteTag(c, resource, id, tag)
}

func deleteTag(c OpenstackCloud, resource string, id string, tag string) error {
	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		err := attributestags.Delete(context.TODO(), c.NetworkingClient(), resource, id, tag).ExtractErr()
		if err != nil {
			return false, fmt.Errorf("error deleting tag %s: %v", tag, err)
		}
		return true, nil
	})
	if err != nil {
		return err
	} else if done {
		return nil
	} else {
		return wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) FindNetworkBySubnetID(subnetID string) (*networks.Network, error) {
	return findNetworkBySubnetID(c, subnetID)
}

func findNetworkBySubnetID(c OpenstackCloud, subnetID string) (*networks.Network, error) {
	var rslt *networks.Network

View on GitHub (pinned to 4c8573c808)

Example fix

// before
err := deleteTag(c, "subnets", subnetID, tag)
// after
if _, err := getSubnet(c, subnetID); err == nil {
    err = deleteTag(c, "subnets", subnetID, tag)
}

Defensive patterns

Strategy: try-catch

Try / catch

if err := deleteTag(c, "subnets", id, tag); err != nil {
    if strings.Contains(err.Error(), "404") || strings.Contains(err.Error(), "Not Found") {
        return nil // already deleted; safe to ignore
    }
    return err
}

Prevention

During cluster teardown, tolerate 404s on tag deletion
Verify resources still exist before mutating tags
Check RBAC policy allows tag mutations
Re-authenticate before long teardown sequences

When it happens

Trigger: NetworkingClient tag delete fails because the resource no longer exists, permissions deny the operation, or the Neutron endpoint is unreachable.

Common situations: Cluster teardown deleting tags from already-deleted subnets/ports/routers; RBAC policy restricting tag mutation; token expiry mid-teardown.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/a808812b1245270b. Report an issue: GitHub.