kubernetes/kops · error

found multiple SecurityGroups with name: %s

Error message

found multiple SecurityGroups with name: %s

What it means

Raised by getSecurityGroupByName (securitygroup.go:77), which is used by SecurityGroup.Find, NewLBTaskFromCloud, and FindDeletions to resolve a security group by its name. Neutron security group names are only unique per project; if listing by name returns more than one group, kOps cannot determine which one to adopt and fails fast instead of mutating the wrong group.

Source

Thrown at upup/pkg/fi/cloudup/openstacktasks/securitygroup.go:77

	if s.RemoveGroup {
		return s, nil
	}
	return getSecurityGroupByName(s, cloud)
}

func getSecurityGroupByName(s *SecurityGroup, cloud openstack.OpenstackCloud) (*SecurityGroup, error) {
	opt := sg.ListOpts{
		Name: fi.ValueOf(s.Name),
	}
	gs, err := cloud.ListSecurityGroups(opt)
	if err != nil {
		return nil, err
	}
	n := len(gs)
	if n == 0 {
		return nil, nil
	} else if n != 1 {
		return nil, fmt.Errorf("found multiple SecurityGroups with name: %s", fi.ValueOf(s.Name))
	}
	g := gs[0]
	actual := &SecurityGroup{
		ID:          new(g.ID),
		Name:        new(g.Name),
		Description: new(g.Description),
		Lifecycle:   s.Lifecycle,
	}
	actual.RemoveExtraRules = s.RemoveExtraRules
	actual.RemoveGroup = s.RemoveGroup
	s.ID = actual.ID
	return actual, nil
}

func (s *SecurityGroup) Run(context *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(s, context)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. List the duplicates: `openstack security group list --name <sg-name>` and note their IDs
2. Determine the correct group (created by kOps, attached to cluster instances/LB) via `openstack port show` / LB listeners
3. Delete the stale duplicates: `openstack security group delete <dup-id>`
4. Re-run `kops update cluster`; going forward, avoid creating security groups that collide with cluster SG names

Example fix

// before
$ openstack security group list --name nodes.<cluster>
+------------+-----------------+
| id         | name            |
| abc123     | nodes.<cluster> |
| def456     | nodes.<cluster> |
// after
$ openstack security group delete def456
$ kops update cluster <name> --yes

// before applying, detect duplicate SG names in the project
groups, _ := groups.List(netClient, groups.ListOpts{Name: sgName}).AllPages()
if len(groups) > 1 { return fmt.Errorf("%d security groups named %q exist; delete duplicates first", len(groups), sgName) }

if err := kopsUpdate(); err != nil {
    if strings.Contains(err.Error(), "found multiple SecurityGroups") {
        log.Fatal("list duplicates with `openstack security group list --name <name>` and delete the stale one")
    }
    return err
}

When it happens

Trigger: cloud.ListSecurityGroups(ListOpts{Name: ...}) returns 2+ groups: someone manually duplicated the cluster's security group, a previous kOps run created a group and then the task's ID was lost (so the next run created another with the same name), or groups with the same name exist across tenants visible to an admin-scoped client.

Common situations: Operator created a test SG with the same name as the cluster SG; leftover SGs from a deleted cluster in the same project; kOps ID state lost after a failed apply causing duplicate creation; running with admin credentials where cross-project SGs with matching names are listed.

Related errors

• error listing security group rules %v: %v
• error extracting security group rules from pages: %v
• error creating security group rule %v: %v
• error deleting security group: %v
• error deleting security group rule: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4f1368d3205072af. Report an issue: GitHub.