kubernetes/kops · error

unexpected target type for deletion: %T

Error message

unexpected target type for deletion: %T

What it means

deleteSecurityGroupRule.Delete asserts the target is an *awsup.AWSAPITarget before calling EC2 RevokeSecurityGroupEgress/Ingress. kOps throws this when deletion is invoked against some other target type (e.g., a dry-run/target-less target), since revocation requires the real AWS API.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/securitygroup.go:249

type deleteSecurityGroupRule struct {
	rule *ec2types.SecurityGroupRule
}

func buildDeleteSecurityGroupRule(rule ec2types.SecurityGroupRule) *deleteSecurityGroupRule {
	d := &deleteSecurityGroupRule{}
	d.rule = &rule
	return d
}

var _ fi.CloudupDeletion = (*deleteSecurityGroupRule)(nil)

func (d *deleteSecurityGroupRule) Delete(t fi.CloudupTarget) error {
	ctx := context.TODO()
	klog.V(2).Infof("deleting security group permission: %v", fi.DebugAsJsonString(d.rule))

	awsTarget, ok := t.(*awsup.AWSAPITarget)
	if !ok {
		return fmt.Errorf("unexpected target type for deletion: %T", t)
	}

	if aws.ToBool(d.rule.IsEgress) {
		request := &ec2.RevokeSecurityGroupEgressInput{
			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

		klog.V(2).Infof("Calling EC2 RevokeSecurityGroupEgress")
		_, err := awsTarget.Cloud.EC2().RevokeSecurityGroupEgress(ctx, request)
		if err != nil {
			return fmt.Errorf("error revoking SecurityGroupEgress: %v", err)
		}
	} else {
		request := &ec2.RevokeSecurityGroupIngressInput{
			GroupId:              d.rule.GroupId,
			SecurityGroupRuleIds: []string{fi.ValueOf(d.rule.SecurityGroupRuleId)},
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Ensure rule deletion runs only under the AWS apply target (kops update --yes / apply phase), not dry-run or terraform targets
2. If seen in dry-run, expect deletion to be skipped/errored by design — run with the AWS target to actually revoke
3. Check kOps version for known bugs around deletion target handling and upgrade
4. Inspect --v=2 logs to see which target was passed to Delete

// ensure deletion runs in apply mode
// kops update cluster --yes  (not --dry-run / --target=terraform)

if _, ok := target.(*awsup.AWSAPITarget); !ok {
  return fmt.Errorf("security group rule deletion requires the AWS API target, got %T", target)
}

if err := kopsUpdateYes(); err != nil && strings.Contains(err.Error(), "unexpected target type") {
  // re-run under the AWS apply target
}

When it happens

Trigger: Deletion of a security group rule (from FindDeletions results) is executed with a target other than AWSAPITarget — e.g., a dry-run Target, Terraform target, or a test target reaching the delete path.

Common situations: Running kops delete/apply flows where orphaned security group rules are garbage-collected under a non-apply target; test harnesses or internal tooling invoking task deletion with the wrong target; kOps bugs mixing target types during targeted deletions.

Related errors

• error terminating instances: %v
• error deleting KeyPair %q: %v
• error deleting EgressOnlyInternetGateway %q: %v
• error deleting autoscaling group %q: %v
• error deleting ec2 LaunchTemplate %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/98c4638aceb00b09. Report an issue: GitHub.