{"record":{"id":"08d0da34f5a9400f","repo":"kubernetes/kops","slug":"failed-to-convert-server-id-q-to-int-w-08d0da","errorCode":null,"errorMessage":"failed to convert server ID %q to int: %w","messagePattern":"failed to convert server ID %q to int: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/hetzner/verifier.go","lineNumber":71,"sourceCode":"\t\thcloud.WithApplication(\"kops\", version.Version),\n\t}\n\thcloudClient := hcloud.NewClient(opts...)\n\n\treturn &hetznerVerifier{\n\t\topt:    *opt,\n\t\tclient: hcloudClient,\n\t}, nil\n}\n\nfunc (h hetznerVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif !strings.HasPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}\n\ttoken = strings.TrimPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix)\n\n\tserverID, err := strconv.ParseInt(token, 10, 64)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to convert server ID %q to int: %w\", token, err)\n\t}\n\tserver, _, err := h.client.Server.GetByID(ctx, serverID)\n\tif err != nil || server == nil {\n\t\treturn nil, fmt.Errorf(\"failed to get info for server %q: %w\", token, err)\n\t}\n\n\tvar addrs []string\n\tvar challengeEndpoints []string\n\tif server.PublicNet.IPv4.IP != nil {\n\t\t// Don't challenge over the public network\n\t\taddrs = append(addrs, server.PublicNet.IPv4.IP.String())\n\t}\n\tfor _, network := range server.PrivateNet {\n\t\tif network.IP != nil {\n\t\t\taddrs = append(addrs, network.IP.String())\n\t\t\tchallengeEndpoints = append(challengeEndpoints, net.JoinHostPort(network.IP.String(), strconv.Itoa(wellknownports.NodeupChallenge)))\n\t\t}\n\t}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/hetzner/verifier.go#L53-L89","documentation":"VerifyToken strips the \"hcloud://\"-style prefix from the presented bootstrap token and parses the remainder as the numeric Hetzner server ID. If the token body isn't a valid int64, parsing fails and the token is rejected. This means the presented token is malformed for this verifier.","triggerScenarios":"A node presents a token whose payload after the prefix is non-numeric (empty, truncated, from a different verifier/provider, or manually forged/edited).","commonSituations":"Token generated on a non-Hetzner environment (metadata lookup failed earlier and produced a bad token); token truncated in transport; using a token from a different kOps cloud provider.","solutions":["Regenerate the token on the Hetzner node using the hetznermetadata authenticator (ensure instance metadata works there).","Log/inspect the presented token (after prefix) to see why it isn't numeric.","Ensure the node uses the Hetzner bootstrap authenticator matching this verifier.","Check for token truncation/corruption in whatever passes the token (config, header)."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"body := strings.TrimPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix)\nif _, err := strconv.ParseInt(body, 10, 64); err != nil {\n  return nil, bootstrap.ErrNotThisVerifier // malformed: not a Hetzner token\n}","typeGuard":"func isHetznerToken(token string) bool {\n  body := strings.TrimPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix)\n  _, err := strconv.ParseInt(body, 10, 64)\n  return err == nil && body != \"\"\n}","tryCatchPattern":null,"preventionTips":["Generate tokens only via the Hetzner metadata authenticator on Hetzner nodes.","Reject malformed tokens with ErrNotThisVerifier instead of hard errors when appropriate.","Validate token format before sending it to the verifier."],"tags":["hetzner","authentication","token"],"backgroundTag":"invalid-bootstrap-token","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}