{"record":{"id":"76ad31e9fa85880c","repo":"kubernetes/kops","slug":"failed-to-get-private-networks-from-hetzner-cloud","errorCode":null,"errorMessage":"failed to get private networks from hetzner cloud metadata: %w","messagePattern":"failed to get private networks from hetzner cloud metadata: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodeup/pkg/model/context.go","lineNumber":608,"sourceCode":"\n\tswitch c.BootConfig.CloudProvider {\n\tcase kops.CloudProviderAWS:\n\t\tconfig, err := awsconfig.LoadDefaultConfig(ctx)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t\t}\n\t\tmetadata := imds.NewFromConfig(config)\n\t\tlocalIPv4, err := getMetadata(ctx, metadata, \"local-ipv4\")\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to get local-ipv4 address from ec2 metadata: %w\", err)\n\t\t}\n\t\tinternalIP = localIPv4\n\n\tcase kops.CloudProviderHetzner:\n\t\tclient := hcloudmetadata.NewClient()\n\t\tprivateNetworksYaml, err := client.PrivateNetworks()\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to get private networks from hetzner cloud metadata: %w\", err)\n\t\t}\n\t\tvar privateNetworks []struct {\n\t\t\tIP           net.IP   `json:\"ip\"`\n\t\t\tAliasIPs     []net.IP `json:\"alias_ips\"`\n\t\t\tInterfaceNum int      `json:\"interface_num\"`\n\t\t\tMACAddress   string   `json:\"mac_address\"`\n\t\t\tNetworkID    int      `json:\"network_id\"`\n\t\t\tNetworkName  string   `json:\"network_name\"`\n\t\t\tNetwork      string   `json:\"network\"`\n\t\t\tSubnet       string   `json:\"subnet\"`\n\t\t\tGateway      net.IP   `json:\"gateway\"`\n\t\t}\n\t\terr = yaml.Unmarshal([]byte(privateNetworksYaml), &privateNetworks)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to convert private networks to object: %w\", err)\n\t\t}\n\t\tfor _, privateNetwork := range privateNetworks {\n\t\t\tif privateNetwork.InterfaceNum == 1 {","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/nodeup/pkg/model/context.go#L590-L626","documentation":"During nodeup bootstrap, GetMetadataLocalIP resolves the node's internal IP. For Hetzner it calls the hcloud metadata service's PrivateNetworks endpoint; if that HTTP call fails (network error, non-200 response, timeout, or metadata service unavailable), the error is wrapped with this message and aborts the build.","triggerScenarios":"nodeup runs on a Hetzner Cloud server but the hcloud metadata endpoint (http://169.254.169.254/hetzner/v1/metadata/private-networks) is unreachable, returns an HTTP error, or times out.","commonSituations":"Server attached to no private network while one is required; metadata service blocked by firewall/ebtables rules; transient Hetzner network outage during node bootstrap; running nodeup outside a real Hetzner instance (e.g. container/CI) with CloudProvider=hetzner.","solutions":["Verify the Hetzner server has metadata service access: curl http://169.254.169.254/hetzner/v1/metadata/private-networks from the node","Attach the server to a Hetzner private network if the cluster config requires one","Check for firewall/ebtables rules blocking the 169.254.169.254 link-local address","Re-run nodeup; the failure may be a transient metadata service outage"],"exampleFix":"// verify metadata reachability before diagnosing kOps\nkubectl exec -it node -- curl -sf http://169.254.169.254/hetzner/v1/metadata/private-networks || echo 'metadata service unreachable'","handlingStrategy":"retry","validationCode":"curl -sf http://169.254.169.254/hetzner/v1/metadata/private-networks >/dev/null && echo OK || echo UNREACHABLE","typeGuard":null,"tryCatchPattern":"ip, err := ctx.GetMetadataLocalIP(nodeCtx)\nif err != nil {\n\tif strings.Contains(err.Error(), \"failed to get private networks from hetzner cloud metadata\") {\n\t\t// retry with backoff; metadata service may be transiently down\n\t\tfor i := 0; i < 3; i++ {\n\t\t\tif ip, err = ctx.GetMetadataLocalIP(nodeCtx); err == nil {\n\t\t\t\tbreak\n\t\t\t}\n\t\t\ttime.Sleep(time.Duration(1<<i) * time.Second)\n\t\t}\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"node bootstrap aborted, metadata unavailable: %w\", err)\n\t}\n}","preventionTips":["Always attach Hetzner servers to a private network when the cluster uses one","Never block 169.254.169.254 with node-level firewalls or ebtables rules","Retry nodeup on transient metadata failures; Hetzner metadata can briefly drop","Test metadata reachability in instance startup scripts before running nodeup"],"tags":["hetzner","metadata-service","network","nodeup"],"backgroundTag":"metadata-service-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}