kubernetes/kops · error

failed to list networks: %w

Error message

failed to list networks: %w

What it means

Returned by listNetworks when GetNetworks(clusterName) fails against the Hetzner Cloud API while discovering cluster network resources for deletion. All Hetzner list functions use the same listByName filtering, so a failing networks.list call aborts cluster discovery. The wrapped error carries the HTTP/API cause.

Source

Thrown at pkg/resources/hetzner/resources.go:100

			ID:      strconv.FormatInt(sshKey.ID, 10),
			Type:    resourceTypeSSHKey,
			Deleter: deleteSSHKey,
			Obj:     sshKey,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listNetworks(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {
	c := cloud.(hetzner.HetznerCloud)
	var resourceTrackers []*resources.Resource

	networks, err := c.GetNetworks(clusterName)
	if err != nil {
		return nil, fmt.Errorf("failed to list networks: %w", err)
	}

	for _, network := range networks {
		resourceTracker := &resources.Resource{
			Name:    network.Name,
			ID:      strconv.FormatInt(network.ID, 10),
			Type:    resourceTypeNetwork,
			Deleter: deleteNetwork,
			Obj:     network,
		}

		resourceTrackers = append(resourceTrackers, resourceTracker)
	}

	return resourceTrackers, nil
}

func listFirewalls(cloud fi.Cloud, clusterName string) ([]*resources.Resource, error) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Test the token: curl -H "Authorization: Bearer $HCLOUD_TOKEN" https://api.hetzner.cloud/v1/networks.
2. Confirm the token belongs to the project that hosts the cluster's networks.
3. Check Hetzner status page and retry if the API returned 5xx/429.
4. Fix proxy/firewall rules so the host can reach api.hetzner.cloud:443.

Example fix

// before: token from wrong project
export HCLOUD_TOKEN=<other-project-token>
// after: token scoped to the cluster's project
export HCLOUD_TOKEN=<correct-project-token>
kops delete cluster --cloud hetzner

resp, err := hc.Get("https://api.hetzner.cloud/v1/networks")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("networks precheck failed: verify HCLOUD_TOKEN and network egress")
}

var hErr hcloud.Error
if errors.As(err, &hErr) && (hErr.Code == hcloud.ErrorCodeUnauthorized || hErr.Code == hcloud.ErrorCodeForbidden) {
    // token invalid or under-scoped for networks
}

networks, err := c.GetNetworks(clusterName)
var hErr hcloud.Error
if errors.As(err, &hErr) && hErr.Code == hcloud.ErrorCodeRateLimitExceeded {
    waitUntil(resetHeader)
    networks, err = c.GetNetworks(clusterName)
}

When it happens

Trigger: Hetzner API GET /networks fails: invalid token, network unreachable, API 5xx, rate limit, or the token's project doesn't contain/allow network listing.

Common situations: Wrong HCLOUD_TOKEN pointing at a different Hetzner project; expired token after team rotation; API outage during a delete run; corporate egress firewall blocking HTTPS to api.hetzner.cloud.

Related errors

• failed to list ssh keys: %w
• failed to list firewalls: %w
• failed to list load balancers: %w
• failed to list servers: %w
• failed to list volumes: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/aa5dd63d55c70f27. Report an issue: GitHub.