{"record":{"id":"d61b838def7637ae","repo":"kubernetes/kops","slug":"s-is-required-d61b83","errorCode":null,"errorMessage":"%s is required","messagePattern":"(.+?) is required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/hetzner/verifier.go","lineNumber":48,"sourceCode":"\t\"k8s.io/kops/pkg/bootstrap\"\n\t\"k8s.io/kops/pkg/wellknownports\"\n\t\"k8s.io/kops/upup/pkg/fi/cloudup/hetzner/hetznermetadata\"\n)\n\ntype HetznerVerifierOptions struct {\n}\n\ntype hetznerVerifier struct {\n\topt    HetznerVerifierOptions\n\tclient *hcloud.Client\n}\n\nvar _ bootstrap.Verifier = (*hetznerVerifier)(nil)\n\nfunc NewHetznerVerifier(opt *HetznerVerifierOptions) (bootstrap.Verifier, error) {\n\thcloudToken := os.Getenv(\"HCLOUD_TOKEN\")\n\tif hcloudToken == \"\" {\n\t\treturn nil, fmt.Errorf(\"%s is required\", \"HCLOUD_TOKEN\")\n\t}\n\n\topts := []hcloud.ClientOption{\n\t\thcloud.WithToken(hcloudToken),\n\t\thcloud.WithApplication(\"kops\", version.Version),\n\t}\n\thcloudClient := hcloud.NewClient(opts...)\n\n\treturn &hetznerVerifier{\n\t\topt:    *opt,\n\t\tclient: hcloudClient,\n\t}, nil\n}\n\nfunc (h hetznerVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {\n\tif !strings.HasPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix) {\n\t\treturn nil, bootstrap.ErrNotThisVerifier\n\t}","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/hetzner/verifier.go#L30-L66","documentation":"NewHetznerVerifier requires the HCLOUD_TOKEN environment variable to construct an authenticated hcloud client. If it's empty, construction fails immediately. Without a token the verifier cannot query the Hetzner API to validate node bootstrap tokens.","triggerScenarios":"The kops verifier command is started without HCLOUD_TOKEN set (or set to an empty string).","commonSituations":"Deploying nodeup/bootstrap verifier without sourcing the env file; systemd unit missing Environment=HCLOUD_TOKEN; token variable name typo.","solutions":["Export a valid Hetzner API token: `export HCLOUD_TOKEN=<token>` and restart the verifier.","Check the service unit/config that launches the verifier includes HCLOUD_TOKEN.","Verify the token is non-empty and valid against the Hetzner API.","Confirm you're not confusing HCLOUD_TOKEN with other provider env vars."],"exampleFix":"// before\n$ kops-hetzner-verifier\n// after\n$ export HCLOUD_TOKEN=$(cat /etc/hetzner/token)\n$ kops-hetzner-verifier","handlingStrategy":"validation","validationCode":"if os.Getenv(\"HCLOUD_TOKEN\") == \"\" {\n  return fmt.Errorf(\"HCLOUD_TOKEN must be set before starting the verifier\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set HCLOUD_TOKEN in the systemd unit or launcher script of any Hetzner verifier component.","Fail fast at startup with an env check.","Never use an empty-string token; treat it as missing."],"tags":["hetzner","env-var","authentication"],"backgroundTag":"missing-env-var","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}