kubernetes/kops · error

failed to delete firewall %s(%s): %w

Error message

failed to delete firewall %s(%s): %w

What it means

Wrapped error from deleteFirewall in kOps' Hetzner resource cleanup, raised when hcloud FirewallClient.Delete fails while removing the cluster firewall during cluster teardown. The hcloud API error is wrapped with %w.

Source

Thrown at pkg/resources/hetzner/resources.go:259

	client := c.NetworkClient()
	network := r.Obj.(*hcloud.Network)
	_, err := client.Delete(context.TODO(), network)
	if err != nil {
		return fmt.Errorf("failed to delete network %s(%s): %w", r.Name, r.ID, err)
	}

	return nil
}

func deleteFirewall(cloud fi.Cloud, r *resources.Resource) error {
	klog.Infof("Deleting Firewall: %s(%s)", r.Name, r.ID)

	c := cloud.(hetzner.HetznerCloud)
	client := c.FirewallClient()
	firewall := r.Obj.(*hcloud.Firewall)
	_, err := client.Delete(context.TODO(), firewall)
	if err != nil {
		return fmt.Errorf("failed to delete firewall %s(%s): %w", r.Name, r.ID, err)
	}

	return nil
}

func deleteLoadBalancer(cloud fi.Cloud, r *resources.Resource) error {
	klog.Infof("Deleting LoadBalancer: %s(%s)", r.Name, r.ID)

	c := cloud.(hetzner.HetznerCloud)
	client := c.LoadBalancerClient()
	loadBalancer := r.Obj.(*hcloud.LoadBalancer)
	_, err := client.Delete(context.TODO(), loadBalancer)
	if err != nil {
		return fmt.Errorf("failed to delete load balancer %s(%s): %w", r.Name, r.ID, err)
	}

	return nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the Hetzner API token is valid with write permissions.
2. Remove the firewall from all servers in the Hetzner console (or let kOps delete the servers first), then retry.
3. If error is not-found, the firewall is already gone — rerun delete; kOps will refresh state.
4. Retry after rate-limit window if the wrapped error is a 429.

fw, _, err := c.Firewall.Get(ctx, name)
if err != nil { return err }
if fw != nil && len(fw.AppliedTo) > 0 {
    return fmt.Errorf("firewall %s still applied to %d resources", name, len(fw.AppliedTo))
}

func isHcloudConflict(err error) bool {
    var hErr hcloud.Error
    return errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeConflict
}

err := deleteFirewall(...)
var hErr hcloud.Error
if errors.As(err, &hErr) {
    switch hErr.Code {
    case hcloud.ErrorCodeNotFound:
        return nil
    case hcloud.ErrorCodeConflict:
        return detachFirewallThenRetry(err)
    }
}
return err

When it happens

Trigger: client.Delete(ctx, firewall) fails: invalid token, firewall applied to servers still active (conflict), rate limit, or firewall already gone (not-found).

Common situations: Token rotated or expired between create and delete; manual edits in Hetzner console left the firewall applied to servers; concurrent kOps delete runs racing on the same firewall.

Related errors

• failed to delete network %s(%s): %w
• failed to delete load balancer %s(%s): %w
• failed to delete server %s(%s): %w
• failed to delete volume %s(%s): %w
• error deleting Subnetwork %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/de0456663089ac6c. Report an issue: GitHub.