kubernetes/kops · error

error listing security group rules %v: %v

Error message

error listing security group rules %v: %v

What it means

This error is returned by listSecurityGroupRules when the OpenStack Neutron security-group-rules List API call fails while paging through results inside vfs.RetryWithBackoff. It wraps the gophercloud SDK error with the ListOpts that were used, so it indicates an API-level failure (auth, connectivity, 403/404, invalid filter) rather than a problem parsing the response. After exhausting retries the wrapped error propagates to the caller of listSecurityGroupRules.

Source

Thrown at upup/pkg/fi/cloudup/openstack/security_group.go:92

		return group, err
	} else if done {
		return group, nil
	} else {
		return group, wait.ErrWaitTimeout
	}
}

func (c *openstackCloud) ListSecurityGroupRules(opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {
	return listSecurityGroupRules(c, opt)
}

func listSecurityGroupRules(c OpenstackCloud, opt sgr.ListOpts) ([]sgr.SecGroupRule, error) {
	var rules []sgr.SecGroupRule

	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		allPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())
		if err != nil {
			return false, fmt.Errorf("error listing security group rules %v: %v", opt, err)
		}

		rs, err := sgr.ExtractRules(allPages)
		if err != nil {
			return false, fmt.Errorf("error extracting security group rules from pages: %v", err)
		}
		rules = rs
		return true, nil
	})
	if err != nil {
		return rules, err
	} else if done {
		return rules, nil
	} else {
		return rules, wait.ErrWaitTimeout
	}
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify OpenStack credentials and that the Neutron (networking) endpoint is reachable, e.g. `openstack security group rule list`
2. Check that the security group IDs / filters in sgr.ListOpts still exist in the target project
3. Inspect the wrapped inner error for HTTP status: 401/403 fix auth or RBAC, 404 fix the ID, 429 slow down (backoff already retries)
4. Confirm the kops cloud config points at the correct region/project

Example fix

// before
allPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())
if err != nil { return false, fmt.Errorf(...) }
// after (verify group exists first)
sg, err := clusters.Get(context.TODO(), c.NetworkingClient(), opt.SecurityGroupID).Extract()
if err != nil { return false, fmt.Errorf("security group %q not found: %v", opt.SecurityGroupID, err) }
allPages, err := sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO())

// before calling listSecurityGroupRules
sg, err := groups.Get(ctx, cloud.NetworkingClient(), sgID).Extract()
if err != nil {
	return fmt.Errorf("security group %q not accessible: %w", sgID, err)
}
if err := cloud.NetworkingClient().GetAuthResult().Err; err != nil {
	return fmt.Errorf("neutron auth invalid: %w", err)
}

func isAuthErr(err error) bool {
	var e1 gophercloud.ErrDefault401
	var e3 gophercloud.ErrDefault403
	return errors.As(err, &e1) || errors.As(err, &e3)
}

rules, err := listSecurityGroupRules(c, sgr.ListOpts{SecurityGroupID: sgID})
if err != nil {
	if isAuthErr(err) {
		// reauthenticate / fix credentials, then retry once
	}
	return fmt.Errorf("listing rules for sg %s: %w", sgID, err)
}

When it happens

Trigger: sgr.List(c.NetworkingClient(), opt).AllPages(context.TODO()) returns an error: Neutron endpoint unreachable, authentication token expired/revoked, the security group or project referenced by opt filters does not exist, or the caller lacks networking API permissions.

Common situations: Misconfigured OS_* cloud credentials or expired tokens, wrong region/endpoint in the cloud config, Neutron service down or at its API rate limit, a kOps cluster spec referencing a security group that was deleted out-of-band, or RBAC policy denying security-group-rule listing.

Related errors

• error extracting security group rules from pages: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v
• failed to list layer 3 floating ips for port ID %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3b91d79090d297ed. Report an issue: GitHub.