kubernetes/kops · error
error listing SecurityGroups: %v
Error message
error listing SecurityGroups: %v
What it means
Wraps an EC2 DescribeSecurityGroups API failure inside SecurityGroup.findEc2, which locates a cluster security group by tags. kOps cannot enumerate security groups so reconciliation of that task aborts.
Source
Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:123
if fi.ValueOf(e.ID) != "" {
// Find by ID.
request.GroupIds = []string{fi.ValueOf(e.ID)}
} else if fi.ValueOf(e.Name) != "" && e.VPC != nil && e.VPC.ID != nil {
// Find by filters (name and VPC ID).
filters := cloud.BuildFilters(e.Name)
filters = append(filters, awsup.NewEC2Filter("vpc-id", *e.VPC.ID))
filters = append(filters, awsup.NewEC2Filter("group-name", *e.Name))
request.Filters = filters
} else {
// No reason to try.
return nil, nil
}
response, err := cloud.EC2().DescribeSecurityGroups(ctx, request)
if err != nil {
return nil, fmt.Errorf("error listing SecurityGroups: %v", err)
}
if response == nil || len(response.SecurityGroups) == 0 {
return nil, nil
}
if len(response.SecurityGroups) != 1 {
return nil, fmt.Errorf("found multiple SecurityGroups matching tags")
}
sg := response.SecurityGroups[0]
return &sg, nil
}
func (e *SecurityGroup) Run(c *fi.CloudupContext) error {
return fi.CloudupDefaultDeltaRunMethod(e, c)
}
func (_ *SecurityGroup) ShouldCreate(a, e, changes *SecurityGroup) (bool, error) {
if fi.ValueOf(e.Shared) {View on GitHub (pinned to 4c8573c808)
Solutions
- Check the wrapped AWS error code in the message
- Add ec2:DescribeSecurityGroups to the kOps IAM policy if AccessDenied/UnauthorizedOperation
- For throttling, re-run later or reduce concurrent task pressure
- Verify network path to EC2 (NAT/VPC endpoint) in the target region
Example fix
{"Effect":"Allow","Action":["ec2:DescribeSecurityGroups"],"Resource":"*"} Defensive patterns
Strategy: try-catch
Validate before calling
aws ec2 describe-security-groups --filters Name=tag:kubernetes.io/cluster/<cluster>,Values=owned --region <region>
Try / catch
if err != nil && strings.Contains(err.Error(), "RequestLimitExceeded") {
// back off, reduce concurrency, retry
} else if err != nil && strings.Contains(err.Error(), "UnauthorizedOperation") {
// add ec2:DescribeSecurityGroups to IAM policy
} Prevention
- Verify IAM describe permissions before large applies
- Split very large clusters to reduce API burst rate
- Check AWS health/dashboard on widespread API errors
When it happens
Trigger: DescribeSecurityGroups call fails during Find or FindDeletions: throttling (RequestLimitExceeded), UnauthorizedOperation/AccessDenied, network/endpoint failures, or SDK timeouts.
Common situations: kOps instance profile missing ec2:DescribeSecurityGroups; VPC endpoint misconfigured; large clusters with many tasks exceeding EC2 rate limits; AWS regional outage.
Related errors
- error describing SecurityGroup rules %q: %v
- error listing SecurityGroups: %v
- error creating AutoScalingGroup: %s
- error listing EventBridge rules: %v
- error getting role: %v
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/af37fc3405248fe1.
Report an issue: GitHub.