Repository navigation
Description
problem
After creating a k8s cluster and adding an IP address with empty start and end ports, I’m unable to delete the cluster; I get the following error:
2025-09-29 16:58:45,581 ERROR [c.c.a.ApiAsyncJobDispatcher] (API-Job-Executor-24:[ctx-6070df23, job-6277]) (logid:7e48a51e) Unexpected exception while executing org.apache.cloudstack.api.command.user.kubernetes.cluster.DeleteKubernetesClusterCmd java.lang.NullPointerException: Cannot invoke "java.lang.Integer.intValue()" because the return value of "com.cloud.network.rules.FirewallRuleVO.getSourcePortStart()" is null
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterResourceModifierActionWorker.removeSshFirewallRule(KubernetesClusterResourceModifierActionWorker.java:518)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.deleteKubernetesClusterIsolatedNetworkRules(KubernetesClusterDestroyWorker.java:160)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.deleteKubernetesClusterNetworkRules(KubernetesClusterDestroyWorker.java:197)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.checkForRulesToDelete(KubernetesClusterDestroyWorker.java:227)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.destroy(KubernetesClusterDestroyWorker.java:299)
at com.cloud.kubernetes.cluster.KubernetesClusterManagerImpl.destroyKubernetesCluster(KubernetesClusterManagerImpl.java:1923)
at com.cloud.kubernetes.cluster.KubernetesClusterManagerImpl.destroyKubernetesCluster(KubernetesClusterManagerImpl.java:1931)
at com.cloud.kubernetes.cluster.KubernetesClusterManagerImpl.deleteKubernetesCluster(KubernetesClusterManagerImpl.java:1598)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
at org.apache.cloudstack.network.contrail.management.EventUtils$EventInterceptor.invoke(EventUtils.java:105)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:175)
at com.cloud.event.ActionEventInterceptor.invoke(ActionEventInterceptor.java:52)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:175)
at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:97)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:215)
at jdk.proxy3/jdk.proxy3.$Proxy517.deleteKubernetesCluster(Unknown Source)
at org.apache.cloudstack.api.command.user.kubernetes.cluster.DeleteKubernetesClusterCmd.execute(DeleteKubernetesClusterCmd.java:95)
at com.cloud.api.ApiDispatcher.dispatch(ApiDispatcher.java:173)
at com.cloud.api.ApiAsyncJobDispatcher.runJob(ApiAsyncJobDispatcher.java:110)
at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl$5.runInContext(AsyncJobManagerImpl.java:652)
at org.apache.cloudstack.managed.context.ManagedContextRunnable$1.run(ManagedContextRunnable.java:49)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext$1.call(DefaultManagedContext.java:56)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.callWithContext(DefaultManagedContext.java:103)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.runWithContext(DefaultManagedContext.java:53)
at org.apache.cloudstack.managed.context.ManagedContextRunnable.run(ManagedContextRunnable.java:46)
at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl$5.run(AsyncJobManagerImpl.java:600)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840)
versions
CloudStack version is 4.20.1
The steps to reproduce the bug
- Create a k8s cluster with an isolated network (IP subnet e.g. 192.168.1.0/24).
- In the Firewall tab, remove all rules.
- Add the following rules:
- 192.168.1.0/24, port start: 6443, port end: 6443
- 1.1.1.1/32, port start: (leave blank), port end: (leave blank)
- Stop the k8s cluster.
- Attempt to delete the k8s cluster → deletion fails.
Workaround that succeeds
Replace the second rule with:
1.1.1.1/32, port start: 1024, port end: 65534
What to do about it?
I would like to have the ability to create rules with blank fields.
Activity
boring-cyborg commentedon Sep 29, 2025
Thanks for opening your first issue here! Be sure to follow the issue template!
kiranchavala commentedon Sep 30, 2025
@baltazorbest
Did you remove the firewall rules on the source nat IP of the network and then try to delete the cks cluster ?
Also, could you mention the k8s version and the hypervisor you are using
Not able to reproduce the issue
Steps that I followed
Create a cks cluster in isolated network > cluster in running state
On the isolated network > source nat IP > delete the firewall for port 6443 and 2223
baltazorbest commentedon Sep 30, 2025
My env:
OS on management and hypervisor hosts: ubuntu 22.04
Libvirt version: 8.0.0-1ubuntu7.12
Storage: Ceph 19.2.3 RBD
K8S version: setup-v1.33.1-calico-x86_64.iso and setup-v1.31.1-calico-x86_64.iso
baltazorbest commentedon Sep 30, 2025
I performed additional tests, and as I observed, the error occurs when I use a previously created network. If the “Network” field is left empty, everything works fine.
kiranchavala commentedon Sep 30, 2025
@baltazorbest able to reproduce the issue
cc @weizhouapache
Logs
weizhouapache commentedon Sep 30, 2025
thanks @kiranchavala
added to 4.20.2 milestone
weizhouapache commentedon Oct 1, 2025
the issue is reproducible
if there are user-defined firewall rules (ALL or other start/end ports), scale/delete CKS cluster will have some issues
it is a bit complicated to fix it, as several code lines are based on the assumption that the firewall rules and port forwarding rules for SSH (to control/worker nodes) start from port 2222.
baltazorbest commentedon Oct 3, 2025
@weizhouapache Hey, thanks for your reply. What do you think about the security risk with the default firewall rules? I mean opening 0.0.0.0/0 for ports 6443 and 2222–22xx.
weizhouapache commentedon Oct 3, 2025
@baltazorbest
I understand your concerns. I agree we should improve it
it is not a simple fix, please keep eye on this issue
codewest commentedon Oct 31, 2025
This bug also seems to result in problems when attempting to add an external instance to a kubernetes cluster, even if your rules are not modified:
This is on ACS 4.21
kiranchavala commentedon Mar 17, 2026
Issue resolved with PR
#12806