kubernetes/kops · error

error updating port: %v

Error message

error updating port: %v

What it means

When changes.AllowedAddressPairs is non-nil, RenderOpenstack updates the port via t.Cloud.UpdatePort with ports.UpdateOpts{AllowedAddressPairs}. A failure from that Neutron port-update call is wrapped as 'error updating port'.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/port.go:292

		return nil
	}
	if changes != nil {
		if changes.Tags != nil {
			klog.V(2).Infof("Updating tags for Port with name: %q", fi.ValueOf(e.Name))
			for _, tag := range e.Tags {
				err := t.Cloud.AppendTag(openstack.ResourceTypePort, fi.ValueOf(a.ID), tag)
				if err != nil {
					return fmt.Errorf("Error appending tag to port: %v", err)
				}
			}
		}
		if changes.AllowedAddressPairs != nil {
			klog.V(2).Infof("Updating allowed address pairs for Port with name: %q", fi.ValueOf(e.Name))
			_, err := t.Cloud.UpdatePort(fi.ValueOf(a.ID), ports.UpdateOpts{
				AllowedAddressPairs: &e.AllowedAddressPairs,
			})
			if err != nil {
				return fmt.Errorf("error updating port: %v", err)
			}
		}
	}
	e.ID = a.ID
	klog.V(2).Infof("Using an existing Openstack port, id=%s", fi.ValueOf(e.ID))
	return nil
}

func portCreateOptsFromPortTask(t *openstack.OpenstackAPITarget, a, e, changes *Port) (ports.CreateOptsBuilder, error) {
	sgs := make([]string, len(e.SecurityGroups)+len(e.AdditionalSecurityGroups))
	for i, sg := range e.SecurityGroups {
		sgs[i] = fi.ValueOf(sg.ID)
	}
	for i, sg := range e.AdditionalSecurityGroups {
		opt := secgroup.ListOpts{
			Name: sg,
		}
		gs, err := t.Cloud.ListSecurityGroups(opt)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped Neutron error for validation details
2. Verify allowed address pairs are permitted by the cloud's port security policy
3. Confirm the port still exists and its ID is valid
4. Re-run kops to retry the update

Example fix

null

for _, p := range port.AllowedAddressPairs {
    if !policyAllowsAddressPair(p.IPAddress) {
        return fmt.Errorf("address pair %s likely rejected by neutron port-security policy", p.IPAddress)
    }
}

_, err := t.Cloud.UpdatePort(fi.ValueOf(a.ID), ports.UpdateOpts{AllowedAddressPairs: &e.AllowedAddressPairs})
if err != nil {
    return fmt.Errorf("error updating port: %v", err) // inspect inner Neutron validation error
}

When it happens

Trigger: Existing port with allowed-address-pair changes: UpdatePort(a.ID, ports.UpdateOpts{AllowedAddressPairs}) returns an error from Neutron (validation of pairs, port deleted, permissions).

Common situations: Allowed address pairs rejected by Neutron policy (e.g. anti-spoofing rules disallow the CIDR); port removed externally between Find and Render; API outage.

Related errors

• failed to find floating ip: %v
• failed to list layer 3 floating ips for port ID %s: %v
• Failed to get port with id %s: %v
• found multiple ports with name: %s
• Error creating port cloud opts: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1418ce90754d288a. Report an issue: GitHub.