kubernetes/kops · error

failed to add node port rules: %v

Error message

failed to add node port rules: %v

What it means

Propagated failure from addNodePortRules while building the OpenStack firewall model: the underlying error (typically a subnet lookup or cloud API failure) occurred while constructing node-port security-group rules. This message is a wrapping layer, not the root cause; inspect the %v detail.

Source

Thrown at pkg/model/openstackmodel/firewall.go:754

	b.addDNSRules(c, sgMap)
	// Add Kubelet Rules
	b.addKubeletRules(c, sgMap)
	// Add Node exporter and occm metrics Rules
	b.addNodeExporterAndOccmRules(c, sgMap)
	// Add kube controller manager metrics Rules
	b.addKubeControllerManagerMetricsRules(c, sgMap)
	// Add kube scheduler metrics Rules
	b.addKubeSchedulerMetricsRules(c, sgMap)
	// Kops-controller Rules
	b.addKopsControllerRules(c, sgMap)
	// Allow necessary local traffic
	b.addCNIRules(c, sgMap)
	// ETCD Leader Election
	b.addETCDRules(c, sgMap)
	// Add NodePort Rules:
	err = b.addNodePortRules(c, sgMap)
	if err != nil {
		return fmt.Errorf("failed to add node port rules: %v", err)
	}

	for _, r := range b.Rules {
		c.AddTask(r)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error text to find the failing rule/subnet
2. Verify all subnets referenced by node-port firewall rules exist in spec.networking.subnets
3. Verify OpenStack connectivity and quotas, then re-run `kops update cluster`

When it happens

Trigger: Thrown at pkg/model/openstackmodel/firewall.go:754 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/22a466f2c6e4e5e3. Report an issue: GitHub.