kubernetes/kops · error

failed to get SSH keys matching label selector %q: %w

Error message

failed to get SSH keys matching label selector %q: %w

What it means

hetznerCloudImplementation.GetSSHKeys lists Hetzner Cloud SSH keys filtered by a label selector using the hcloud client's AllWithOpts. If the paginated listing fails, the error is wrapped with the selector for context. This is an API-level failure, not 'no keys found'.

Source

Thrown at upup/pkg/fi/cloudup/hetzner/cloud.go:147

// VolumeClient returns an implementation of hetzner.VolumeClient
func (c *hetznerCloudImplementation) VolumeClient() hcloud.VolumeClient {
	return c.Client.Volume
}

func (c *hetznerCloudImplementation) GetSSHKeys(clusterName string) ([]*hcloud.SSHKey, error) {
	client := c.SSHKeyClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	sshKeyListOpts := hcloud.SSHKeyListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), sshKeyListOpts)
	if err != nil {
		return nil, fmt.Errorf("failed to get SSH keys matching label selector %q: %w", labelSelector, err)
	}

	return matches, nil
}

func (c *hetznerCloudImplementation) GetNetworks(clusterName string) ([]*hcloud.Network, error) {
	client := c.NetworkClient()

	labelSelector := TagKubernetesClusterName + "=" + clusterName
	listOptions := hcloud.ListOpts{
		PerPage:       50,
		LabelSelector: labelSelector,
	}
	networkListOptions := hcloud.NetworkListOpts{ListOpts: listOptions}

	matches, err := client.AllWithOpts(context.TODO(), networkListOptions)
	if err != nil {
		return nil, fmt.Errorf("failed to get networks matching label selector %q: %w", labelSelector, err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the Hetzner API token is valid: `hcloud ssh-key list` with the same token/env
2. Check network connectivity/proxy settings to api.hetzner.cloud
3. Validate the label selector syntax (e.g. 'kubernetes.io/cluster/<name>=<cluster-id>')
4. Wait and retry if rate-limited (HTTP 429 in wrapped error)

test -n "$HCLOUD_TOKEN" && curl -s -H "Authorization: Bearer $HCLOUD_TOKEN" https://api.hetzner.cloud/v1/ssh_keys | head -c 200

keys, err := GetSSHKeys(ctx, selector)
if err != nil { return fmt.Errorf("hetzner ssh key lookup failed (check HCLOUD_TOKEN/connectivity): %w", err) }

When it happens

Trigger: client.AllWithOpts(context.TODO(), sshKeyListOpts) errors: invalid hcloud API token, network failure to api.hetzner.cloud, rate limiting, or a malformed label selector string.

Common situations: Expired or revoked HCLOUD_API_TOKEN; wrong token for the project containing the cluster; corporate proxy/firewall blocking api.hetzner.cloud; typo in labelSelector producing a 400 from the API; Hetzner API rate limits during large applies.

Related errors

• failed to delete network %s(%s): %w
• failed to delete firewall %s(%s): %w
• failed to delete load balancer %s(%s): %w
• failed to delete server %s(%s): %w
• failed to delete volume %s(%s): %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/60fb8a828ef8d632. Report an issue: GitHub.