kubernetes/kops · error

error listing SecurityGroups: %v

Error message

error listing SecurityGroups: %v

What it means

DescribeSecurityGroups in pkg/resources/aws/securitygroup.go calls EC2 DescribeSecurityGroups once per cluster-tag filter set (owned + shared) and wraps any API error with this message. It is the inventory step used by ListSecurityGroups during cluster deletion/dump, so a failure prevents discovery of cluster security groups.

Source

Thrown at pkg/resources/aws/securitygroup.go:160

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func DescribeSecurityGroups(cloud fi.Cloud, clusterName string) (map[string]ec2types.SecurityGroup, error) {
	ctx := context.TODO()
	c := cloud.(awsup.AWSCloud)

	groups := make(map[string]ec2types.SecurityGroup)
	klog.V(2).Infof("Listing EC2 SecurityGroups")
	for _, filters := range buildEC2FiltersForCluster(clusterName) {
		request := &ec2.DescribeSecurityGroupsInput{
			Filters: filters,
		}
		response, err := c.EC2().DescribeSecurityGroups(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error listing SecurityGroups: %v", err)
		}

		for _, group := range response.SecurityGroups {
			groups[aws.ToString(group.GroupId)] = group
		}
	}

	return groups, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure IAM grants ec2:DescribeSecurityGroups.
2. Verify credentials/session and target region match the cluster.
3. Back off and retry on RequestLimitExceeded / throttling.
4. Check network connectivity to the EC2 endpoint (VPC endpoint, proxy, DNS).

// preflight describe access
_, err := ec2Client.DescribeSecurityGroups(ctx, &ec2.DescribeSecurityGroupsInput{MaxResults: aws.Int32(1)})
if err != nil { return fmt.Errorf("ec2:DescribeSecurityGroups preflight failed: %w", err) }

func isThrottlingErr(err error) bool {
    c := awsup.AWSErrorCode(err)
    return c == "RequestLimitExceeded" || c == "Throttling" || c == "RequestThrottled"
}

groups, err := DescribeSecurityGroups(cloud, clusterName)
if err != nil {
    if isThrottlingErr(err) { time.Sleep(backoff); groups, err = DescribeSecurityGroups(cloud, clusterName) }
    if err != nil { return nil, err }
}

When it happens

Trigger: ec2.DescribeSecurityGroups with cluster-tag Filters returning UnauthorizedOperation (missing ec2:DescribeSecurityGroups), InvalidFilter values (e.g. bad tag key), RequestLimitExceeded throttling, invalid credentials, or network failures.

Common situations: Least-privilege IAM missing DescribeSecurityGroups; running kOps with an expired SSO/STS session; throttling when many resource types are listed concurrently; tag filter mismatch is not the cause here (that yields empty results, not an error).

Related errors

• error listing RouteTables: %v
• error describing SecurityGroup rules %q: %v
• error listing SecurityGroup: %v
• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b915eb4e4d4520b8. Report an issue: GitHub.