kubernetes/kops · error

error revoking SecurityGroupEgress: %v

Error message

error revoking SecurityGroupEgress: %v

What it means

Wraps a failure from the EC2 RevokeSecurityGroupEgress API while the deleteSecurityGroupRule task is deleting an extra egress rule on a security group during `kops update` reconciliation. The wrapped AWS error (auth, throttling, invalid rule id, deleted group, etc.) is appended verbatim. It is raised only when d.rule.IsEgress is true in deleteSecurityGroupRule.Delete.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:261

func (d *deleteSecurityGroupRule) Delete(t fi.CloudupTarget) error {
	ctx := context.TODO()
	klog.V(2).Infof("deleting security group permission: %v", fi.DebugAsJsonString(d.rule))

	awsTarget, ok := t.(*awsup.AWSAPITarget)
	if !ok {
		return fmt.Errorf("unexpected target type for deletion: %T", t)
	}

	if aws.ToBool(d.rule.IsEgress) {
		request := &ec2.RevokeSecurityGroupEgressInput{
			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

		klog.V(2).Infof("Calling EC2 RevokeSecurityGroupEgress")
		_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)
		if err != nil {
			return fmt.Errorf("error revoking SecurityGroupEgress: %v", err)
		}
	} else {
		request := &ec2.RevokeSecurityGroupIngressInput{
			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

		klog.V(2).Infof("Calling EC2 RevokeSecurityGroupIngress")
		_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupIngress(ctx, request)
		if err != nil {
			return fmt.Errorf("error revoking SecurityGroupIngress: %v", err)
		}
	}

	return nil
}

func (d *deleteSecurityGroupRule) TaskName() string {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops update cluster --yes` — most causes (stale rule id, already-deleted rule) self-heal on the next reconciliation
2. Run `aws ec2 describe-security-group-rules --filter Name=group-id,Values=<sg-id>` to check whether the rule/group still exists
3. Check `kops toolbox dump` / IAM: ensure credentials and the IAM policy ec2:RevokeSecurityGroupEgress are valid
4. Retry after a short wait if the wrapped error is throttling (RequestLimitExceeded)

Example fix

// N/A — error surfaces from AWS; caller-side retry is the fix (null if not applicable)

// Before applying, confirm the egress rule id still exists:
aws ec2 describe-security-group-rules \
  --filters Name=group-id,Values=$SG_ID Name=security-group-rule-id,Values=$RULE_ID \
  --query 'SecurityGroupRules[0].SecurityGroupRuleId'

// kops surfaces this as a wrapped error; when automating:
if err := apply(); err != nil {
  if strings.Contains(err.Error(), "error revoking SecurityGroupEgress") {
    // transient (throttle/stale id) → sleep and re-run the update
    time.Sleep(30 * time.Second); retryApply()
  }
}

When it happens

Trigger: FindDeletions produced a CloudupDeletion for an egress rule (via removeExtraRules) and the subsequent RevokeSecurityGroupEgress call failed — e.g. InvalidGroup.NotFound (group already deleted), InvalidPermission.NotFound / InvalidSecurityGroupRuleId.NotFound (rule already revoked or ID stale from a cached Describe), throttling (RequestLimitExceeded), or revoked IAM credentials.

Common situations: Racing deletions where the security group was removed between Describe and Revoke; running kops concurrently in two processes causing double-revoke of the same rule id; expired AWS session/credentials mid-run; an operator manually deleted the rule in the AWS console while kops was applying.

Related errors

• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v
• cannot revoke ingress for ID %q with rule IDs %v: %v
• error deleting SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/61d41e39620388fa. Report an issue: GitHub.