kubernetes/kops · error

error revoking SecurityGroupIngress: %v

Error message

error revoking SecurityGroupIngress: %v

What it means

Wraps a failure from the EC2 RevokeSecurityGroupIngress API while deleteSecurityGroupRule.Delete removes an extra ingress rule from a security group during reconciliation. The underlying AWS error is passed through unchanged. Taken when d.rule.IsEgress is false, i.e. the stale rule is an ingress rule.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:272

			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

		klog.V(2).Infof("Calling EC2 RevokeSecurityGroupEgress")
		_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)
		if err != nil {
			return fmt.Errorf("error revoking SecurityGroupEgress: %v", err)
		}
	} else {
		request := &ec2.RevokeSecurityGroupIngressInput{
			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

		klog.V(2).Infof("Calling EC2 RevokeSecurityGroupIngress")
		_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupIngress(ctx, request)
		if err != nil {
			return fmt.Errorf("error revoking SecurityGroupIngress: %v", err)
		}
	}

	return nil
}

func (d *deleteSecurityGroupRule) TaskName() string {
	return "SecurityGroupRule"
}

func (d *deleteSecurityGroupRule) Item() string {
	s := fi.ValueOf(d.rule.GroupId) + ":"
	p := d.rule
	if aws.ToInt32(p.FromPort) != 0 {
		s += fmt.Sprintf(" port=%d", aws.ToInt32(p.FromPort))
		if aws.ToInt32(p.ToPort) != aws.ToInt32(p.FromPort) {
			s += fmt.Sprintf("-%d", aws.ToInt32(p.ToPort))
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run `kops update cluster --yes`; stale-rule and already-deleted cases resolve on retry
2. Verify the rule/group still exists with `aws ec2 describe-security-group-rules --filter Name=group-id,Values=<sg-id>`
3. Confirm valid credentials and ec2:RevokeSecurityGroupIngress permission (`aws sts get-caller-identity`)
4. If throttled, wait and retry with fewer concurrent applies

// Confirm the ingress rule still exists before/instead of a blind revoke:
aws ec2 describe-security-group-rules \
  --filters Name=group-id,Values=$SG_ID \
  --query 'SecurityGroupRules[?IsEgress==`false`].[SecurityGroupRuleId,FromPort,ToPort]'

if err := apply(); err != nil {
  if strings.Contains(err.Error(), "error revoking SecurityGroupIngress") {
    // stale-rule / throttle cases heal on retry
    time.Sleep(30 * time.Second); retryApply()
  }
}

When it happens

Trigger: A CloudupDeletion for an ingress rule (matched by removeExtraRules in FindDeletions) triggers RevokeSecurityGroupIngress, which fails with InvalidGroup.NotFound (SG gone), InvalidPermission.NotFound/InvalidSecurityGroupRuleId.NotFound (rule already revoked or stale ID), throttling, or credential errors.

Common situations: Manual rule deletion in AWS console concurrent with kops apply; two kops runs racing; VPC/SG deleted by another automation (e.g. terraform) before revoke; region/credential misconfiguration in the kops state store or environment.

Related errors

• error describing SecurityGroup %q: %v
• found multiple SecurityGroups with ID %q
• error describing SecurityGroup rules %q: %v
• cannot revoke ingress for ID %q with rule IDs %v: %v
• error deleting SecurityGroup %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/00ab2119cca47607. Report an issue: GitHub.