{"record":{"id":"f3c5bbaeab84b910","repo":"kubernetes/kops","slug":"failed-to-retrieve-server-id-w","errorCode":null,"errorMessage":"failed to retrieve server ID: %w","messagePattern":"failed to retrieve server ID: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/hetzner/hetznermetadata/authenticator.go","lineNumber":44,"sourceCode":"\t\"github.com/hetznercloud/hcloud-go/v2/hcloud/metadata\"\n\t\"k8s.io/kops/pkg/bootstrap\"\n)\n\nconst HetznerAuthenticationTokenPrefix = \"x-hetzner-id \" //nolint:gosec // This is an authentication scheme prefix, not a credential.\n\ntype hetznerAuthenticator struct {\n}\n\nvar _ bootstrap.Authenticator = (*hetznerAuthenticator)(nil)\n\nfunc NewHetznerAuthenticator() (bootstrap.Authenticator, error) {\n\treturn &hetznerAuthenticator{}, nil\n}\n\nfunc (h *hetznerAuthenticator) CreateToken(body []byte) (string, error) {\n\tserverID, err := metadata.NewClient().InstanceID()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to retrieve server ID: %w\", err)\n\t}\n\treturn HetznerAuthenticationTokenPrefix + strconv.FormatInt(serverID, 10), nil\n}\n","sourceCodeStart":26,"sourceCodeEnd":48,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/hetzner/hetznermetadata/authenticator.go#L26-L48","documentation":"The Hetzner authenticator's CreateToken retrieves the instance's own server ID from the Hetzner instance metadata service (http://169.254.169.254/hetzner/v1/metadata). If the metadata lookup fails, the token cannot be built. This only works when code runs ON a Hetzner Cloud server.","triggerScenarios":"metadata.NewClient().InstanceID() fails: code running outside a Hetzner server (laptop, CI), metadata service unreachable/firewalled, or the HTTP request timed out.","commonSituations":"Running kOps verifier/bootstrap logic locally for debugging; running on a non-Hetzner node or inside a container where the link-local metadata address isn't routable; Hetzner metadata service hiccup.","solutions":["Run the authenticator on an actual Hetzner Cloud server (metadata service is only available there).","Check reachability: `curl -s http://169.254.169.254/hetzner/v1/metadata/instance-id`.","Ensure no firewall/iptables rules block 169.254.169.254 on the instance.","If in a container, use host networking or run the component on the host."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"resp, err := http.Get(\"http://169.254.169.254/hetzner/v1/metadata/instance-id\")\nif err != nil || resp.StatusCode != 200 { /* not on a Hetzner server; use a different authenticator */ }","typeGuard":"func onHetznerInstance() bool {\n  c := http.Client{Timeout: 2 * time.Second}\n  resp, err := c.Get(\"http://169.254.169.254/hetzner/v1/metadata/instance-id\")\n  return err == nil && resp.StatusCode == 200\n}","tryCatchPattern":"token, err := h.CreateToken(body)\nif err != nil {\n  if _, mErr := metadata.NewClient().InstanceID(); mErr != nil {\n    return \"\", fmt.Errorf(\"not running on a Hetzner Cloud server; metadata unavailable: %w\", mErr)\n  }\n  return \"\", err\n}","preventionTips":["Only run components using the Hetzner authenticator on Hetzner servers.","Test metadata reachability (curl 169.254.169.254) before deployment.","Avoid containers with isolated networking for metadata-dependent components."],"tags":["hetzner","metadata","authentication"],"backgroundTag":"metadata-service-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}