kubernetes/kops · error

error revoking SecurityGroup: %v

Error message

error revoking SecurityGroup: %v

What it means

After the target type is confirmed as *openstack.OpenstackAPITarget, deleteSecurityGroup.Delete calls Cloud.DeleteSecurityGroup(id) to remove the security group via Neutron; this error wraps any failure of that DELETE /security_groups/{id} call. Common wrapped causes are 404 (group already gone), 409 conflict (group still attached to ports/interfaces), and auth/network failures.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:248

	return true
}

type deleteSecurityGroup struct {
	securityGroup *SecurityGroup
}

var _ fi.CloudupDeletion = (*deleteSecurityGroup)(nil)

func (d *deleteSecurityGroup) Delete(t fi.CloudupTarget) error {
	klog.V(2).Infof("deleting security group: %v", fi.DebugAsJsonString(d.securityGroup.Name))

	os, ok := t.(*openstack.OpenstackAPITarget)
	if !ok {
		return fmt.Errorf("unexpected target type for deletion: %T", t)
	}
	err := os.Cloud.DeleteSecurityGroup(fi.ValueOf(d.securityGroup.ID))
	if err != nil {
		return fmt.Errorf("error revoking SecurityGroup: %v", err)
	}
	return nil
}

func (d *deleteSecurityGroup) TaskName() string {
	return "SecurityGroup"
}

func (d *deleteSecurityGroup) Item() string {
	s := fmt.Sprintf("securitygroup=%s", fi.ValueOf(d.securityGroup.Name))
	return s
}

func (d *deleteSecurityGroup) DeferDeletion() bool {
	return false // TODO: Should we defer deletion?
}

type deleteSecurityGroupRule struct {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped '%v' detail: 409 means the group is still in use — delete or detach the ports/instances referencing it first.
2. If 404, the group is already gone; re-run kops delete/update so FindDeletions no longer sees it.
3. Verify credentials and Neutron reachability (openstack token issue) and retry.
4. Ensure all instances and load balancers in the cluster are deleted before deleting the security group.

Example fix

// before: fails with conflict
kops delete cluster --name mycluster --yes
// error revoking SecurityGroup: Conflict: security group is in use by port X
// after: delete dependent resources first
openstack port list --security-group <sg-id>
kops delete cluster --name mycluster --yes

// before deleting, ensure no ports still reference the group
page, _ := ports.List(neutron, ports.ListOpts{SecurityGroupID: sgID}).AllPages()
plist, _ := ports.ExtractPorts(page)
if len(plist) > 0 { // group still in use; detach or delete dependent resources first
}

func isNotFound(err error) bool { return strings.Contains(err.Error(), "404") || strings.Contains(err.Error(), "not found") }
func isInUse(err error) bool { return strings.Contains(err.Error(), "409") || strings.Contains(err.Error(), "in use") }

err := os.Cloud.DeleteSecurityGroup(fi.ValueOf(d.securityGroup.ID))
if err != nil {
	if isNotFound(err) {
		return nil // already deleted; treat as success
	}
	if isInUse(err) {
		// detach/delete dependent ports, then retry with backoff
	}
	return fmt.Errorf("error revoking SecurityGroup: %w", err)
}

When it happens

Trigger: FindDeletions created a deleteSecurityGroup removal (RemoveGroup=true) and the subsequent Delete() call to Neutron fails — most often a 409 because instances/ports still reference the group, a 404 because it was deleted concurrently, or a 401 from expired credentials.

Common situations: Trying to tear down a security group while VMs/ports using it still exist; concurrent kops applies or manual `openstack security group delete`; OpenStack project quota/auth issues during cluster deletion.

Related errors

• error listing security group rules %v: %v
• error extracting security group rules from pages: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1791016014519b41. Report an issue: GitHub.