kubernetes/kops · error

error revoking SecurityGroupRule: %v

Error message

error revoking SecurityGroupRule: %v

What it means

Deleting (revoking) an OpenStack security-group rule failed via DeleteSecurityGroupRule. The wrapped error identifies the Neutron rejection; often the rule was already removed or the group is in a transitional state.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:282

}

type deleteSecurityGroupRule struct {
	rule          sgr.SecGroupRule
	securityGroup *SecurityGroup
}

var _ fi.CloudupDeletion = (*deleteSecurityGroupRule)(nil)

func (d *deleteSecurityGroupRule) Delete(t fi.CloudupTarget) error {
	klog.V(2).Infof("deleting security group permission: %v", fi.DebugAsJsonString(d.rule))

	os, ok := t.(*openstack.OpenstackAPITarget)
	if !ok {
		return fmt.Errorf("unexpected target type for deletion: %T", t)
	}
	err := os.Cloud.DeleteSecurityGroupRule(d.rule.ID)
	if err != nil {
		return fmt.Errorf("error revoking SecurityGroupRule: %v", err)
	}
	return nil
}

func (d *deleteSecurityGroupRule) TaskName() string {
	return "SecurityGroupRule"
}

func (d *deleteSecurityGroupRule) Item() string {
	s := ""
	if d.rule.PortRangeMin != 0 {
		s += fmt.Sprintf(" port=%d", d.rule.PortRangeMin)
		if d.rule.PortRangeMin != d.rule.PortRangeMax {
			s += fmt.Sprintf("-%d", d.rule.PortRangeMax)
		}
	}
	s += " protocol=tcp"
	s += fmt.Sprintf(" ip=%s", d.rule.RemoteIPPrefix)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped error; treat already-deleted rules as success
2. Verify the security group is not in a transitional state
3. Retry the deletion

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:282 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/62bf5cdab5b92785. Report an issue: GitHub.