kubernetes/kops · error

failed to get networks matching label selector %q: %w

Error message

failed to get networks matching label selector %q: %w

What it means

hetznerCloudImplementation.GetNetworks lists Hetzner Cloud networks filtered by label selector via AllWithOpts. Any listing error is wrapped with the selector. It indicates the Hetzner Networks API call failed, not that no networks match.

Source

Thrown at upup/pkg/fi/cloudup/hetzner/cloud.go:165

		return nil, fmt.Errorf("failed to get SSH keys matching label selector %q: %w", labelSelector, err)
	}

	return matches, nil
}

func (c *hetznerCloudImplementation) GetNetworks(clusterName string) ([]*hcloud.Network, error) {
	client := c.NetworkClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	networkListOptions := hcloud.NetworkListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), networkListOptions)
	if err != nil {
		return nil, fmt.Errorf("failed to get networks matching label selector %q: %w", labelSelector, err)
	}

	return matches, nil
}

func (c *hetznerCloudImplementation) GetFirewalls(clusterName string) ([]*hcloud.Firewall, error) {
	client := c.FirewallClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	firewallListOptions := hcloud.FirewallListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), firewallListOptions)
	if err != nil {
		return nil, fmt.Errorf("failed to get firewalls matching label selector %q: %w", labelSelector, err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify token validity/scopes: `hcloud network list` with the same credentials
2. Check Hetzner Cloud status page for API incidents
3. Validate the label selector string used in the cluster spec
4. Retry after backoff if rate-limited

curl -s -H "Authorization: Bearer $HCLOUD_TOKEN" 'https://api.hetzner.cloud/v1/networks?label_selector=kubernetes.io%2Fcluster%3D<name>' | head -c 200

nets, err := GetNetworks(ctx, selector)
if err != nil { return fmt.Errorf("hetzner network lookup failed (check token/scopes): %w", err) }

When it happens

Trigger: client.AllWithOpts(context.TODO(), networkListOptions) errors: bad API token, network/API outage, rate limiting, malformed label selector, or network connectivity failure.

Common situations: Token lacking read scope for networks; Hetzner API incident (check status.hetzner.com); invalid selector label key/value typo in the cluster config; rate limits when many resources are reconciled at once.

Related errors

• failed to delete network %s(%s): %w
• error querying for DNS zones: %v
• failed to get private networks from hetzner cloud metadata:
• failed to list networks: %w
• failed to delete firewall %s(%s): %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/181e92d39f2de05e. Report an issue: GitHub.