{"record":{"id":"abc5ac70e9fdcab2","repo":"kubernetes/kops","slug":"failed-to-get-firewalls-matching-label-selector-q","errorCode":null,"errorMessage":"failed to get firewalls matching label selector %q: %w","messagePattern":"failed to get firewalls matching label selector %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/hetzner/cloud.go","lineNumber":183,"sourceCode":"\t\treturn nil, fmt.Errorf(\"failed to get networks matching label selector %q: %w\", labelSelector, err)\n\t}\n\n\treturn matches, nil\n}\n\nfunc (c *hetznerCloudImplementation) GetFirewalls(clusterName string) ([]*hcloud.Firewall, error) {\n\tclient := c.FirewallClient()\n\n\tlabelSelector := TagKubernetesClusterName + \"=\" + clusterName\n\tlistOptions := hcloud.ListOpts{\n\t\tPerPage:       50,\n\t\tLabelSelector: labelSelector,\n\t}\n\tfirewallListOptions := hcloud.FirewallListOpts{ListOpts: listOptions}\n\n\tmatches, err := client.AllWithOpts(context.TODO(), firewallListOptions)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get firewalls matching label selector %q: %w\", labelSelector, err)\n\t}\n\n\treturn matches, nil\n}\n\nfunc (c *hetznerCloudImplementation) GetLoadBalancers(clusterName string) ([]*hcloud.LoadBalancer, error) {\n\tclient := c.LoadBalancerClient()\n\n\tlabelSelector := TagKubernetesClusterName + \"=\" + clusterName\n\tlistOptions := hcloud.ListOpts{\n\t\tPerPage:       50,\n\t\tLabelSelector: labelSelector,\n\t}\n\tloadBalancerListOptions := hcloud.LoadBalancerListOpts{ListOpts: listOptions}\n\n\tmatches, err := client.AllWithOpts(context.TODO(), loadBalancerListOptions)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get load balancers matching label selector %q: %w\", labelSelector, err)","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/hetzner/cloud.go#L165-L201","documentation":"GetFirewalls wraps any error returned by the Hetzner Cloud API call client.AllWithOpts (hcloud.FirewallClient) when listing firewalls by the cluster label selector (<tag>=<clusterName>). It means the firewall list request to api.hetzner.cloud failed; the underlying cause (auth, network, rate limit, API error) is preserved via %w.","triggerScenarios":"Calling GetFirewalls when the Hetzner API token is invalid/expired, the network is down, the API returns 429 (rate limit) or 5xx, or pagination via AllWithOpts fails.","commonSituations":"kOps cluster operations (validate/rolling-update/delete) with HCLOUD_TOKEN unset or revoked, Hetzner API outage, or exhausting the API rate limit on large clusters.","solutions":["Check HCLOUD_TOKEN is set and valid for the project owning the cluster","Re-run after a short wait if the cause is a 429 rate limit or transient 5xx","Verify network/DNS access to api.hetzner.cloud from the host running kOps","Inspect the wrapped %w cause with errors.Unwrap/errors.Is for the exact hcloud error"],"exampleFix":"// before\nfirewalls, err := cloud.GetFirewalls(clusterName)\n// after\nif err != nil {\n\tif hcloudErr, ok := errors.Unwrap(err).(*hcloud.Error); ok && hcloudErr.Code == hcloud.ErrorCodeRateLimit {\n\t\ttime.Sleep(time.Duration(hcloudErr.RateLimit.RetryAfter())\n\t\tfirewalls, err = cloud.GetFirewalls(clusterName)\n\t}\n}","handlingStrategy":"try-catch","validationCode":"if os.Getenv(\"HCLOUD_TOKEN\") == \"\" {\n\treturn fmt.Errorf(\"HCLOUD_TOKEN must be set before calling GetFirewalls\")\n}","typeGuard":"var hcloudErr *hcloud.Error\nif errors.As(err, &hcloudErr) {\n\t// inspect hcloudErr.Code / hcloudErr.Response\n}","tryCatchPattern":"firewalls, err := cloud.GetFirewalls(clusterName)\nif err != nil {\n\tvar hErr *hcloud.Error\n\tif errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeRateLimit {\n\t\ttime.Sleep(hErr.RateLimit.RetryAfter())\n\t\tfirewalls, err = cloud.GetFirewalls(clusterName)\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n}","preventionTips":["Set and verify HCLOUD_TOKEN before any kOps operation","Respect Hetzner rate limits; serialize bulk operations","Monitor Hetzner status page for API incidents","Check errors.As(*hcloud.Error) to branch on specific codes"],"tags":["hetzner","api","network","firewall"],"backgroundTag":"hetzner-api-request-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}