kubernetes/kops · error

Failed to create member: %v

Error message

Failed to create member: %v

What it means

RenderOpenstack associates each matching server to the Octavia pool via Cloud.AssociateToPool with CreateMemberOpts (name, protocol port, VIP subnet, fixed-IP address). If Octavia rejects the member-creation call, kOps wraps the error with this message and the pool member is not created.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/poolassociation.go:185

		for _, server := range serverList {
			val, ok := server.Metadata["k8s"]
			if !ok || val != fi.ValueOf(e.ClusterName) {
				continue
			}

			memberAddress, err := GetServerFixedIP(t.Cloud.ComputeClient(), &server, fi.ValueOf(e.InterfaceName))
			if err != nil {
				return err
			}

			member, err := t.Cloud.AssociateToPool(&server, fi.ValueOf(e.Pool.ID), v2pools.CreateMemberOpts{
				Name:         fi.ValueOf(e.Name),
				ProtocolPort: fi.ValueOf(e.ProtocolPort),
				SubnetID:     fi.ValueOf(e.Pool.Loadbalancer.VipSubnet),
				Address:      memberAddress,
			})
			if err != nil {
				return fmt.Errorf("Failed to create member: %v", err)
			}
			e.ID = new(member.ID)
		}
	} else {
		_, err := t.Cloud.UpdateMemberInPool(fi.ValueOf(a.Pool.ID), fi.ValueOf(a.ID), v2pools.UpdateMemberOpts{
			Weight: e.Weight,
		})
		if err != nil {
			return fmt.Errorf("Failed to update member: %v", err)
		}
	}
	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped Octavia error: 400/409 usually means subnet or port conflict
2. Verify Pool.Loadbalancer.VipSubnet is the subnet containing the server's fixed IP
3. Ensure the loadbalancer is in ACTIVE state (`openstack loadbalancer status show <lb>`); fix pending states first
4. Confirm ProtocolPort is valid and not already assigned to another pool member
5. Check Octavia quota and the kops credentials' member-management permissions

Example fix

// before
SubnetID: fi.ValueOf(e.Pool.Loadbalancer.VipSubnet) // VIP subnet != node subnet
// after: use the subnet of the resolved memberAddress so Octavia accepts the member

// ensure member address subnet matches the VIP subnet before associating
if subnetOf(memberAddress) != fi.ValueOf(e.Pool.Loadbalancer.VipSubnet) {
	return fmt.Errorf("member address %s not in VIP subnet %s", memberAddress, vipSubnet)
}
// and ensure LB is ACTIVE
status, _ := exec.Command("openstack", "loadbalancer", "status", "show", lbID).Output()
if !bytes.Contains(status, []byte("ACTIVE")) { return fmt.Errorf("LB not ACTIVE") }

func memberOptsValid(opts v2pools.CreateMemberOpts) bool {
	return opts.Address != "" && opts.SubnetID != "" &&
		*opts.ProtocolPort > 0 && *opts.ProtocolPort <= 65535
}

member, err := t.Cloud.AssociateToPool(&server, poolID, opts)
if err != nil {
	var gerr gophercloud.ErrUnexpectedResponseCode
	if errors.As(err, &gerr) && gerr.Actual == 409 {
		// LB pending or duplicate member: reconcile LB state then retry
	}
	return fmt.Errorf("Failed to create member: %v", err)
}

When it happens

Trigger: t.Cloud.AssociateToPool(&server, poolID, CreateMemberOpts{...}) errors: subnet mismatch (member address not in VipSubnet), invalid ProtocolPort (out of range/duplicate), pool's loadbalancer not in ACTIVE state, 409 conflict, or quota/permission failure on Octavia.

Common situations: VipSubnet differs from the subnet the server's fixed IP lives on (most common); loadbalancer stuck in PENDING_* state from a previous failed operation; protocol port already used by another member; Octavia quota exceeded.

Related errors

• Failed to update member: %v
• failed to build load balancer client: %w
• error building lb client: %w
• loadbalancer API versions not found
• GetApiIngressStatus: Failed to list openstack loadbalancers:

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bbb27a3f34b98943. Report an issue: GitHub.