{"record":{"id":"aa5dd63d55c70f27","repo":"kubernetes/kops","slug":"failed-to-list-networks-w","errorCode":null,"errorMessage":"failed to list networks: %w","messagePattern":"failed to list networks: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/hetzner/resources.go","lineNumber":100,"sourceCode":"\t\t\tID:      strconv.FormatInt(sshKey.ID, 10),\n\t\t\tType:    resourceTypeSSHKey,\n\t\t\tDeleter: deleteSSHKey,\n\t\t\tObj:     sshKey,\n\t\t}\n\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc listNetworks(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {\n\tc := cloud.(hetzner.HetznerCloud)\n\tvar resourceTrackers []*resources.Resource\n\n\tnetworks, err := c.GetNetworks(clusterName)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to list networks: %w\", err)\n\t}\n\n\tfor _, network := range networks {\n\t\tresourceTracker := &resources.Resource{\n\t\t\tName:    network.Name,\n\t\t\tID:      strconv.FormatInt(network.ID, 10),\n\t\t\tType:    resourceTypeNetwork,\n\t\t\tDeleter: deleteNetwork,\n\t\t\tObj:     network,\n\t\t}\n\n\t\tresourceTrackers = append(resourceTrackers, resourceTracker)\n\t}\n\n\treturn resourceTrackers, nil\n}\n\nfunc listFirewalls(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/hetzner/resources.go#L82-L118","documentation":"Returned by listNetworks when GetNetworks(clusterName) fails against the Hetzner Cloud API while discovering cluster network resources for deletion. All Hetzner list functions use the same listByName filtering, so a failing networks.list call aborts cluster discovery. The wrapped error carries the HTTP/API cause.","triggerScenarios":"Hetzner API GET /networks fails: invalid token, network unreachable, API 5xx, rate limit, or the token's project doesn't contain/allow network listing.","commonSituations":"Wrong HCLOUD_TOKEN pointing at a different Hetzner project; expired token after team rotation; API outage during a delete run; corporate egress firewall blocking HTTPS to api.hetzner.cloud.","solutions":["Test the token: curl -H \"Authorization: Bearer $HCLOUD_TOKEN\" https://api.hetzner.cloud/v1/networks.","Confirm the token belongs to the project that hosts the cluster's networks.","Check Hetzner status page and retry if the API returned 5xx/429.","Fix proxy/firewall rules so the host can reach api.hetzner.cloud:443."],"exampleFix":"// before: token from wrong project\nexport HCLOUD_TOKEN=<other-project-token>\n// after: token scoped to the cluster's project\nexport HCLOUD_TOKEN=<correct-project-token>\nkops delete cluster --cloud hetzner","handlingStrategy":"retry","validationCode":"resp, err := hc.Get(\"https://api.hetzner.cloud/v1/networks\")\nif err != nil || resp.StatusCode != 200 {\n    return fmt.Errorf(\"networks precheck failed: verify HCLOUD_TOKEN and network egress\")\n}","typeGuard":"var hErr hcloud.Error\nif errors.As(err, &hErr) && (hErr.Code == hcloud.ErrorCodeUnauthorized || hErr.Code == hcloud.ErrorCodeForbidden) {\n    // token invalid or under-scoped for networks\n}","tryCatchPattern":"networks, err := c.GetNetworks(clusterName)\nvar hErr hcloud.Error\nif errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeRateLimitExceeded {\n    waitUntil(resetHeader)\n    networks, err = c.GetNetworks(clusterName)\n}","preventionTips":["Confirm the token belongs to the correct Hetzner project before running kops.","Rotate and distribute tokens through a secret manager instead of shell history.","Test connectivity to api.hetzner.cloud:443 from the host running kops.","Back off on 429 responses and check X-Ratelimit-Reset headers."],"tags":["hetzner","network","api","cloud-provider"],"backgroundTag":"cloud-api-auth-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}