juju using Openstack provider does not remove security groups on remove-machine after a failed provisioning

Is this happening if you also just 'juju remove-machine' without '--force' ?
What is the underlying error state, is the issue that the machine never came up, or it did come up but then ended up hanging after a while with an error.
Certainly we shouldn't be leaking security groups as a general case. And we should be trying to clean them up even with '--force'. It does mean that if we fail to clean them up, likely '--force' will still progress the removal of the rest of the machine information because you asked us to.

However, if any 'juju remove-machine' leaks a security group, that is definitely something we should be fixing. I also wonder if 'force' makes us progress faster, and that leaves us hitting something like "cannot remove security group because it is still in use".

[Expired for juju because there has been no activity for 60 days.]

We're still seeing this, even with 2.9.21.

We're using --force in this environment that I'm looking at (the prometheus check one). It was recently switched to using --force since the juju controller issues post-upgrade and was leaking resources causing us to manually clean them up. Resources being juju applications, units, and OpenStack instances.

So you are using --force, which says "even if you get errors during cleanup, continue to remove the machine from the model", which is somewhat likely to leave things like security groups behind (if the initial request to clean them up had failed).