kubernetes/kops · error

not a supported security group type

Error message

not a supported security group type

What it means

GetSecurityGroups hit the default switch branch: the instance group's role is not one of control-plane, node, or bastion, so no security-group template exists for it. The role field on the instance group is the input at fault.

Source

Thrown at pkg/model/awsmodel/firewall.go:376

			Description:      new("Security group for nodes"),
			RemoveExtraRules: []string{"port=22"},
		}
		baseGroup.Tags = b.CloudTags(name, false)
	case kops.InstanceGroupRoleBastion:
		name := b.SecurityGroupName(role)
		baseGroup = &awstasks.SecurityGroup{
			Name:        new(name),
			VPC:         b.LinkToVPC(),
			Description: new("Security group for bastion"),
			RemoveExtraRules: []string{
				"port=22",  // SSH
				"port=3:4", // ICMP
				"port=-1",  // ICMPv6
			},
		}
		baseGroup.Tags = b.CloudTags(name, false)
	default:
		return nil, fmt.Errorf("not a supported security group type")
	}
	var groups []SecurityGroupInfo

	done := make(map[string]bool)

	// Build groups that specify a SecurityGroupOverride
	allOverrides := true
	for _, ig := range b.InstanceGroups {
		if ig.Spec.Role != role {
			continue
		}

		if ig.Spec.SecurityGroupOverride == nil {
			allOverrides = false
			continue
		}

		name := fi.ValueOf(ig.Spec.SecurityGroupOverride)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the instance group's spec.role is a supported value
2. Fix or remove the malformed instance group
3. Report upstream if a legitimately new role needs support

When it happens

Trigger: Thrown at pkg/model/awsmodel/firewall.go:376 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bc9edcede7a74e58. Report an issue: GitHub.