What causes "openstack cloud provider does not support surging" in kubernetes/kops?

Do not use surging with OpenStack; use the default in-place rolling update strategy (no surge)

openstack cloud provider does not support surging

Error message

openstack cloud provider does not support surging

What it means

detachInstance is a deliberately unimplemented stub in the OpenStack cloud provider: it logs that DetachInstance is not implemented and always returns this error. kops calls it when performing surging (rolling updates that add a new instance before draining the old one), which OpenStack does not support.

Source

Thrown at upup/pkg/fi/cloudup/openstack/instance.go:315

		newStats, err := c.GetLBStats(lb.ID)
		if err != nil {
			return err
		}

		// NOTE! this is total loadbalancer connections NOT member connections
		klog.V(4).Infof("Loadbalancer %s connections before draining %d and after %d", lb.Name, oldStats.ActiveConnections, newStats.ActiveConnections)
	}
	return nil
}

// DetachInstance is not implemented yet. It needs to cause a cloud instance to no longer be counted against the group's size limits.
func (c *openstackCloud) DetachInstance(i *cloudinstances.CloudInstance) error {
	return detachInstance(c, i)
}

func detachInstance(c OpenstackCloud, i *cloudinstances.CloudInstance) error {
	klog.V(8).Info("openstack cloud provider DetachInstance not implemented yet")
	return fmt.Errorf("openstack cloud provider does not support surging")
}

func (c *openstackCloud) GetInstance(id string) (*servers.Server, error) {
	return getInstance(c, id)
}

func getInstance(c OpenstackCloud, id string) (*servers.Server, error) {
	var server *servers.Server

	done, err := vfs.RetryWithBackoff(readBackoff, func() (bool, error) {
		instance, err := servers.Get(context.TODO(), c.ComputeClient(), id).Extract()
		if err != nil {
			return false, err
		}
		server = instance
		return true, nil
	})
	if err != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

Do not use surging with OpenStack; use the default in-place rolling update strategy (no surge)
If surging is required, switch the affected instance groups to a provider that implements DetachInstance (AWS/GCE)
Implement detachInstance in the OpenStack provider (e.g. via server rebuild/migration or LB member handling) if upstream support is needed

Example fix

// before: rolling-update with surge on openstack
kops rolling-update cluster mycluster --surge
// after: use default in-place update
kops rolling-update cluster mycluster

Defensive patterns

Strategy: fallback

Validate before calling

// detect provider capability before requesting surge
if cloud.ProviderID() == kopsapi.CloudProviderOpenstack && updateStrategyUsesSurge {
    return fmt.Errorf("surge not supported on openstack; use in-place rolling update")
}

Prevention

Never configure --surge or surge-style rolling updates for OpenStack clusters
Check provider feature parity docs before enabling cloud-specific update strategies
If you need surging, run those instance groups on AWS/GCE instead
Track upstream kops for OpenStack DetachInstance implementation

When it happens

Trigger: Any call path that invokes DetachInstance for an OpenStack cluster — i.e. a rolling-update strategy that requires detaching (surging) an instance from the cloud instance group instead of deleting it in place.

Common situations: Running `kops rolling-update cluster` with surge configured on an OpenStack cluster; tooling expecting feature parity between AWS/GCE and OpenStack providers.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/e1e1e4d69aec955c. Report an issue: GitHub.