kubernetes/kops · error

error extracting security group rules from pages: %v

Error message

error extracting security group rules from pages: %v

What it means

This error is returned when sgr.ExtractRules fails to decode the paginated Neutron security-group-rule response into []sgr.SecGroupRule. It means the API responded but the payload could not be parsed/extracted, which in practice indicates an unexpected response shape or an error page returned as a 200. The error is wrapped by vfs.RetryWithBackoff and retried, then propagated to callers of listSecurityGroupRules.

Source

Thrown at upup/pkg/fi/cloudup/openstack/security_group.go:97

	}
}

func (c *openstackCloud) ListSecurityGroupRules(opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {
	return listSecurityGroupRules(c, opt)
}

func listSecurityGroupRules(c OpenstackCloud, opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {
	var rules []sgr.SecGroupRule

	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		allPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())
		if err != nil {
			return false, fmt.Errorf("error listing security group rules %v: %v", opt, err)
		}

		rs, err := sgr.ExtractRules(allPages)
		if err != nil {
			return false, fmt.Errorf("error extracting security group rules from pages: %v", err)
		}
		rules = rs
		return true, nil
	})
	if err != nil {
		return rules, err
	} else if done {
		return rules, nil
	} else {
		return rules, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) CreateSecurityGroupRule(opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {
	return createSecurityGroupRule(c, opt)
}

func createSecurityGroupRule(c OpenstackCloud, opt sgr.CreateOptsBuilder) (*sgr.SecGroupRule, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the operation; transient proxy/gateway errors often resolve (backoff already retries a few times)
2. Upgrade or align the gophercloud (openstack) dependency with the target cloud's Neutron API version
3. Capture the raw response body and check for an HTML/proxy error page instead of JSON
4. Verify no intermediate proxy is mangling the Neutron response

// probe the API health/format before extracting
resp, err := cloud.NetworkingClient().Get(cloud.NetworkingClient().EndpointURL(), nil, nil)
if err != nil || resp.StatusCode != 200 {
	return fmt.Errorf("neutron endpoint unhealthy or returning non-JSON: status=%v err=%v", resp, err)
}

func isExtractionErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "extracting security group rules from pages")
}

rules, err := listSecurityGroupRules(c, opt)
if err != nil {
	if isExtractionErr(err) {
		// log raw response, upgrade gophercloud, retry after backoff
	}
	return err
}

When it happens

Trigger: sgr.ExtractRules(allPages) returns an error because the collected pages do not contain the expected JSON structure (e.g. an HTML error page from a proxy, a truncated response, or a Neutron microversion returning a different schema).

Common situations: A load balancer / API proxy intercepting Neutron responses, an outdated gophercloud SDK incompatible with the cloud's Neutron API version, or a misbehaving OpenStack deployment returning malformed bodies.

Related errors

• error listing security group rules %v: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v
• Failed to update security group for port %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d2b4d33b49923fe3. Report an issue: GitHub.