kubernetes/kops · error

failed to get firewalls matching label selector %q: %w

Error message

failed to get firewalls matching label selector %q: %w

What it means

GetFirewalls wraps any error returned by the Hetzner Cloud API call client.AllWithOpts (hcloud.FirewallClient) when listing firewalls by the cluster label selector (<tag>=<clusterName>). It means the firewall list request to api.hetzner.cloud failed; the underlying cause (auth, network, rate limit, API error) is preserved via %w.

Source

Thrown at upup/pkg/fi/cloudup/hetzner/cloud.go:183

		return nil, fmt.Errorf("failed to get networks matching label selector %q: %w", labelSelector, err)
	}

	return matches, nil
}

func (c *hetznerCloudImplementation) GetFirewalls(clusterName string) ([]*hcloud.Firewall, error) {
	client := c.FirewallClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	firewallListOptions := hcloud.FirewallListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), firewallListOptions)
	if err != nil {
		return nil, fmt.Errorf("failed to get firewalls matching label selector %q: %w", labelSelector, err)
	}

	return matches, nil
}

func (c *hetznerCloudImplementation) GetLoadBalancers(clusterName string) ([]*hcloud.LoadBalancer, error) {
	client := c.LoadBalancerClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	loadBalancerListOptions := hcloud.LoadBalancerListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), loadBalancerListOptions)
	if err != nil {
		return nil, fmt.Errorf("failed to get load balancers matching label selector %q: %w", labelSelector, err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check HCLOUD_TOKEN is set and valid for the project owning the cluster
2. Re-run after a short wait if the cause is a 429 rate limit or transient 5xx
3. Verify network/DNS access to api.hetzner.cloud from the host running kOps
4. Inspect the wrapped %w cause with errors.Unwrap/errors.Is for the exact hcloud error

Example fix

// before
firewalls, err := cloud.GetFirewalls(clusterName)
// after
if err != nil {
	if hcloudErr, ok := errors.Unwrap(err).(*hcloud.Error); ok && hcloudErr.Code == hcloud.ErrorCodeRateLimit {
		time.Sleep(time.Duration(hcloudErr.RateLimit.RetryAfter())
		firewalls, err = cloud.GetFirewalls(clusterName)
	}
}

if os.Getenv("HCLOUD_TOKEN") == "" {
	return fmt.Errorf("HCLOUD_TOKEN must be set before calling GetFirewalls")
}

var hcloudErr *hcloud.Error
if errors.As(err, &hcloudErr) {
	// inspect hcloudErr.Code / hcloudErr.Response
}

firewalls, err := cloud.GetFirewalls(clusterName)
if err != nil {
	var hErr *hcloud.Error
	if errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeRateLimit {
		time.Sleep(hErr.RateLimit.RetryAfter())
		firewalls, err = cloud.GetFirewalls(clusterName)
	}
	if err != nil {
		return err
	}
}

When it happens

Trigger: Calling GetFirewalls when the Hetzner API token is invalid/expired, the network is down, the API returns 429 (rate limit) or 5xx, or pagination via AllWithOpts fails.

Common situations: kOps cluster operations (validate/rolling-update/delete) with HCLOUD_TOKEN unset or revoked, Hetzner API outage, or exhausting the API rate limit on large clusters.

Related errors

• failed to list networks: %w
• failed to list firewalls: %w
• failed to get load balancers matching label selector %q: %w
• failed to get servers matching label selector %q: %w
• failed to get volumes matching label selector %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/abc5ac70e9fdcab2. Report an issue: GitHub.