kubernetes/kops · error

failed to list load balancers: %w

Error message

failed to list load balancers: %w

What it means

Returned by listLoadBalancers when GetLoadBalancers(clusterName) fails while enumerating Hetzner Cloud Load Balancers during cluster deletion discovery. Without a successful load_balancers.list, kops cannot identify load balancers tagged for the cluster and aborts. The cause is in the wrapped hcloud error.

Source

Thrown at pkg/resources/hetzner/resources.go:148

			ID:      strconv.FormatInt(firewall.ID, 10),
			Type:    resourceTypeFirewall,
			Deleter: deleteFirewall,
			Obj:     firewall,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listLoadBalancers(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {
	c := cloud.(hetzner.HetznerCloud)
	var resourceTrackers []*resources.Resource

	loadBalancers, err := c.GetLoadBalancers(clusterName)
	if err != nil {
		return nil, fmt.Errorf("failed to list load balancers: %w", err)
	}

	for _, loadBalancer := range loadBalancers {
		resourceTracker := &resources.Resource{
			Name:    loadBalancer.Name,
			ID:      strconv.FormatInt(loadBalancer.ID, 10),
			Type:    resourceTypeLoadBalancer,
			Deleter: deleteLoadBalancer,
			Obj:     loadBalancer,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listServers(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify token validity: curl -H "Authorization: Bearer $HCLOUD_TOKEN" https://api.hetzner.cloud/v1/load_balancers.
2. Issue a fresh project-scoped read/write token if the current one is invalid or under-scoped.
3. Back off and retry on 429/5xx; add delays between consecutive kops cloud operations.
4. Check Hetzner status page for outages before debugging credentials.

resp, err := hc.Get("https://api.hetzner.cloud/v1/load_balancers")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("load balancer API precheck failed; check token and connectivity")
}

var hErr hcloud.Error
if errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeUnauthorized {
    // invalid token
}

lbs, err := c.GetLoadBalancers(clusterName)
var hErr hcloud.Error
if errors.As(err, &hErr) {
    if hErr.Code == hcloud.ErrorCodeRateLimitExceeded || (isServerError(hErr)) {
        time.Sleep(backoff)
        lbs, err = c.GetLoadBalancers(clusterName)
    }
}

When it happens

Trigger: Hetzner load_balancers.list API call fails: bad/missing API token, rate limit exceeded, Hetzner API outage, or network failure.

Common situations: Token lacks read permissions on the project; token rotated by ops team but kops env not updated; hitting Hetzner API rate limits during automated cleanup jobs; transient API errors.

Related errors

• failed to list ssh keys: %w
• failed to list networks: %w
• failed to list firewalls: %w
• failed to list servers: %w
• failed to list volumes: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/38cf7e15c278ad56. Report an issue: GitHub.