kubernetes/kops · error

failed to list firewalls: %w

Error message

failed to list firewalls: %w

What it means

Returned by listFirewalls when GetFirewalls(clusterName) fails during Hetzner cluster resource discovery. kops lists firewalls to find cluster-scoped ones for deletion; an API failure here stops the discovery phase entirely. The original hcloud SDK error is wrapped with %w for inspection via errors.Is/As.

Source

Thrown at pkg/resources/hetzner/resources.go:124

			ID:      strconv.FormatInt(network.ID, 10),
			Type:    resourceTypeNetwork,
			Deleter: deleteNetwork,
			Obj:     network,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listFirewalls(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {
	c := cloud.(hetzner.HetznerCloud)
	var resourceTrackers []*resources.Resource

	firewalls, err := c.GetFirewalls(clusterName)
	if err != nil {
		return nil, fmt.Errorf("failed to list firewalls: %w", err)
	}

	for _, firewall := range firewalls {
		resourceTracker := &resources.Resource{
			Name:    firewall.Name,
			ID:      strconv.FormatInt(firewall.ID, 10),
			Type:    resourceTypeFirewall,
			Deleter: deleteFirewall,
			Obj:     firewall,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listLoadBalancers(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Validate credentials with curl -H "Authorization: Bearer $HCLOUD_TOKEN" https://api.hetzner.cloud/v1/firewalls.
2. If the wrapped error is 429 (rate_limit_exceeded), wait (check X-Ratelimit-Reset header) and retry.
3. Check status.hetzner.com for ongoing API incidents and retry after resolution.
4. Ensure a stable network connection / correct HTTPS proxy settings for API access.

if _, err := hc.ListFirewalls(ctx, hcloud.FirewallListOpts{}); err != nil {
    return fmt.Errorf("firewalls precheck failed: %w", err)
}

var hErr hcloud.Error
if errors.As(err, &hErr) && (hErr.Code == hcloud.ErrorCodeRateLimitExceeded || hErr.Code == hcloud.ErrorCodeUnauthorized) {
    // classify before deciding retry vs credential fix
}

firewalls, err := c.GetFirewalls(clusterName)
if err != nil {
    var hErr hcloud.Error
    if errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeRateLimitExceeded {
        time.Sleep(rateLimitBackoff)
        firewalls, err = c.GetFirewalls(clusterName)
    }
}

When it happens

Trigger: Hetzner firewalls.list API call errors: authentication failure, rate limiting, API outage, or network interruption between kops and api.hetzner.cloud.

Common situations: HCLOUD_TOKEN revoked or mistyped; exceeding Hetzner API rate limits when many delete/verify operations run back-to-back; Hetzner API incident causing 500s.

Related errors

• failed to list ssh keys: %w
• failed to list networks: %w
• failed to list load balancers: %w
• failed to list servers: %w
• failed to list volumes: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/bbfb510755aa6ece. Report an issue: GitHub.