kubernetes/kops · error

Failed to update security group for port %s: %v

Error message

Failed to update security group for port %s: %v

What it means

After creating the load balancer, kOps attaches the configured security group to the LB's VIP port via the Neutron ports update API. This error means that ports.Update call failed, so the VIP port still has the default security groups.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/lb.go:231

			lbopts.FlavorID = fi.ValueOf(e.FlavorID)
		}
		lb, err := t.Cloud.CreateLB(lbopts)
		if err != nil {
			return fmt.Errorf("error creating LB: %v", err)
		}
		e.ID = new(lb.ID)
		e.PortID = new(lb.VipPortID)
		e.VipSubnet = new(lb.VipSubnetID)
		e.Provider = new(lb.Provider)
		e.FlavorID = new(lb.FlavorID)

		if e.SecurityGroup != nil {
			opts := ports.UpdateOpts{
				SecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},
			}
			_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), lb.VipPortID, opts).Extract()
			if err != nil {
				return fmt.Errorf("Failed to update security group for port %s: %v", lb.VipPortID, err)
			}
		}
		return nil
	}
	// We may have failed to update the security groups on the load balancer
	port, err := t.Cloud.GetPort(fi.ValueOf(a.PortID))
	if err != nil {
		return fmt.Errorf("Failed to get port with id %s: %v", fi.ValueOf(a.PortID), err)
	}
	// Ensure the loadbalancer port has one security group and it is the one specified,
	if e.SecurityGroup != nil &&
		(len(port.SecurityGroups) < 1 || port.SecurityGroups[0] != fi.ValueOf(e.SecurityGroup.ID)) {

		opts := ports.UpdateOpts{
			SecurityGroups: &[]string{fi.ValueOf(e.SecurityGroup.ID)},
		}
		_, err = ports.Update(context.TODO(), t.Cloud.NetworkingClient(), fi.ValueOf(a.PortID), opts).Extract()
		if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped error for 403 — grant the user the neutron update_port policy permission (or use an admin-authorized deployment)
2. Verify the security group exists in the same project: `openstack security group show <id>`
3. Re-run `kops update cluster`; the reconcile loop retries port SG updates on existing LBs (see line 248 path)

// Pre-check SG exists and user can update ports
openstack security group show $SG_ID
openstack port show $LB_VIP_PORT_ID

_, err = ports.Update(ctx, client, lb.VipPortID, opts).Extract()
if err != nil {
    var gerr gophercloud.ErrUnexpectedResponseCode
    if errors.As(err, &gerr) && gerr.StatusCode == 403 {
        return fmt.Errorf("missing neutron update_port permission for %s: %w", lb.VipPortID, err)
    }
    return fmt.Errorf("Failed to update security group for port %s: %w", lb.VipPortID, err)
}

When it happens

Trigger: Fresh LB creation path (a == nil) where e.SecurityGroup is set and ports.Update on lb.VipPortID returns an error — typically 403 from Neutron policy, or the security group / port no longer exists.

Common situations: User's OpenStack role lacks update_port permission on the port owned by the octavia project; the referenced security group ID was deleted or lives in another project; transient neutron API failure during cluster create.

Related errors

• error listing security group rules %v: %v
• error extracting security group rules from pages: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4a8990981994e7e0. Report an issue: GitHub.