kubernetes/kops · error
Failed to get port with id %s: %v
Error message
Failed to get port with id %s: %v
What it means
On the update path, kOps fetches the LB's existing VIP port (t.Cloud.GetPort) to verify its security groups. This error means that port GET failed, so kOps cannot reconcile the LB security group state.
Source
Thrown at upup/pkg/fi/cloudup/openstacktasks/lb.go:239
e.VipSubnet = new(lb.VipSubnetID)
e.Provider = new(lb.Provider)
e.FlavorID = new(lb.FlavorID)
if e.SecurityGroup != nil {
opts := ports.UpdateOpts{
SecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},
}
_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), lb.VipPortID, opts).Extract()
if err != nil {
return fmt.Errorf("Failed to update security group for port %s: %v", lb.VipPortID, err)
}
}
return nil
}
// We may have failed to update the security groups on the load balancer
port, err := t.Cloud.GetPort(fi.ValueOf(a.PortID))
if err != nil {
return fmt.Errorf("Failed to get port with id %s: %v", fi.ValueOf(a.PortID), err)
}
// Ensure the loadbalancer port has one security group and it is the one specified,
if e.SecurityGroup != nil &&
(len(port.SecurityGroups) < 1 || port.SecurityGroups[0] != fi.ValueOf(e.SecurityGroup.ID)) {
opts := ports.UpdateOpts{
SecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},
}
_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), fi.ValueOf(a.PortID), opts).Extract()
if err != nil {
return fmt.Errorf("Failed to update security group for port %s: %v", fi.ValueOf(a.PortID), err)
}
return nil
}
klog.V(2).Infof("Openstack task LB::RenderOpenstack did nothing")
return nil
}View on GitHub (pinned to 4c8573c808)
Solutions
- Check if the LB still exists: `openstack loadbalancer show <id>`; if deleted, remove it from kops state (`kops delete instancegroup`/edit cluster or re-import) so it is recreated
- Run `openstack port show <port-id>` with the same credentials to confirm visibility/permissions
- Inspect the wrapped error for 403 — request port:show permission for the kOps user
- Retry after confirming neutron API health
Example fix
// before: stale LB in state store after manual deletion kops update cluster --name mycluster // error: Failed to get port with id ...: resource not found // after: reconcile cloud state first kops delete cluster --name mycluster --yes # or recreate the LB in OpenStack kops update cluster --name mycluster --yes
Defensive patterns
Strategy: validation
Validate before calling
// Before updating the cluster, confirm the LB and its VIP port still exist openstack port show $(kops toolbox dump cluster -o json | jq -r './/.portId // empty') 2>/dev/null || \ echo 'LB port missing from cloud — state store is stale'
Prevention
- Never delete Octavia load balancers directly in OpenStack; use kops-managed deletion
- Compare `openstack port list` against kops state when a manual cleanup was required
- Ensure the OS_* project used by kOps can see the LB ports (same tenant or admin role)
When it happens
Trigger: Existing-LB reconcile (`kops update cluster`/`kops replace`) where the port identified by a.PortID cannot be fetched — the LB was deleted out-of-band, the port ID is stale in the kops state store, or the Neutron API call failed (403/404/timeout).
Common situations: Someone deleted the Octavia LB directly in OpenStack while kops state still references it; credentials scoped to a project that cannot see the port; neutron outage during update.
Related errors
- failed to find floating ip: %v
- failed to list layer 3 floating ips for port ID %s: %v
- multiple floating ips associated to port: %s
- found multiple ports with name: %s
- Error creating port cloud opts: %v
AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05).
Data as JSON: /api/errors/93a18c110819a4ef.
Report an issue: GitHub.