kubernetes/kops · error

public IP address %q referenced by security rule %q does not

Error message

public IP address %q referenced by security rule %q does not have an allocated address

What it means

Validation guard when rendering an Azure Network Security Group rule that references a source public IP address: the referenced PublicIPAddress object exists but has no allocated IPAddress value yet. Fires when the PIP is still provisioning or failed to allocate, since the rule needs a concrete address prefix.

Source

Thrown at upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go:202

	if a == nil {
		klog.Infof("Creating a new Network Security Group with name: %s", fi.ValueOf(e.Name))
	} else {
		klog.Infof("Updating a Network Security Group with name: %s", fi.ValueOf(e.Name))
	}

	p := network.SecurityGroup{
		Properties: &network.SecurityGroupPropertiesFormat{
			SecurityRules: []*network.SecurityRule{},
		},
		Location: to.Ptr(t.Cloud.Region()),
		Name:     to.Ptr(*e.Name),
		Tags:     e.Tags,
	}
	for _, nsr := range e.SecurityRules {
		sourceAddressPrefix := nsr.SourceAddressPrefix
		if nsr.SourcePublicIPAddress != nil {
			if nsr.SourcePublicIPAddress.IPAddress == nil {
				return fmt.Errorf("public IP address %q referenced by security rule %q does not have an allocated address", fi.ValueOf(nsr.SourcePublicIPAddress.Name), fi.ValueOf(nsr.Name))
			}
			sourceAddressPrefix = nsr.SourcePublicIPAddress.IPAddress
		}
		securityRule := network.SecurityRule{
			Name: nsr.Name,
			Properties: &network.SecurityRulePropertiesFormat{
				Priority:                   nsr.Priority,
				Access:                     &nsr.Access,
				Direction:                  &nsr.Direction,
				Protocol:                   &nsr.Protocol,
				SourceAddressPrefix:        sourceAddressPrefix,
				SourceAddressPrefixes:      nsr.SourceAddressPrefixes,
				SourcePortRange:            nsr.SourcePortRange,
				DestinationAddressPrefix:   nsr.DestinationAddressPrefix,
				DestinationAddressPrefixes: nsr.DestinationAddressPrefixes,
				DestinationPortRange:       nsr.DestinationPortRange,
			},
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Wait for the public IP allocation to complete and re-run the operation
2. Check the public IP resource is not in a failed state
3. Verify the correct public IP resource is referenced in the security rule spec

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/azuretasks/networksecuritygroup.go:202 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/89f90090f648ff0d. Report an issue: GitHub.