kubernetes/kops · error

failed to retrieve server ID: %w

Error message

failed to retrieve server ID: %w

What it means

The Hetzner authenticator's CreateToken retrieves the instance's own server ID from the Hetzner instance metadata service (http://169.254.169.254/hetzner/v1/metadata). If the metadata lookup fails, the token cannot be built. This only works when code runs ON a Hetzner Cloud server.

Source

Thrown at upup/pkg/fi/cloudup/hetzner/hetznermetadata/authenticator.go:44

	"github.com/hetznercloud/hcloud-go/v2/hcloud/metadata"
	"k8s.io/kops/pkg/bootstrap"
)

const HetznerAuthenticationTokenPrefix = "x-hetzner-id " //nolint:gosec // This is an authentication scheme prefix, not a credential.

type hetznerAuthenticator struct {
}

var _ bootstrap.Authenticator = (*hetznerAuthenticator)(nil)

func NewHetznerAuthenticator() (bootstrap.Authenticator, error) {
	return &hetznerAuthenticator{}, nil
}

func (h *hetznerAuthenticator) CreateToken(body []byte) (string, error) {
	serverID, err := metadata.NewClient().InstanceID()
	if err != nil {
		return "", fmt.Errorf("failed to retrieve server ID: %w", err)
	}
	return HetznerAuthenticationTokenPrefix + strconv.FormatInt(serverID, 10), nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Run the authenticator on an actual Hetzner Cloud server (metadata service is only available there).
2. Check reachability: `curl -s http://169.254.169.254/hetzner/v1/metadata/instance-id`.
3. Ensure no firewall/iptables rules block 169.254.169.254 on the instance.
4. If in a container, use host networking or run the component on the host.

resp, err := http.Get("http://169.254.169.254/hetzner/v1/metadata/instance-id")
if err != nil || resp.StatusCode != 200 { /* not on a Hetzner server; use a different authenticator */ }

func onHetznerInstance() bool {
  c := http.Client{Timeout: 2 * time.Second}
  resp, err := c.Get("http://169.254.169.254/hetzner/v1/metadata/instance-id")
  return err == nil && resp.StatusCode == 200
}

token, err := h.CreateToken(body)
if err != nil {
  if _, mErr := metadata.NewClient().InstanceID(); mErr != nil {
    return "", fmt.Errorf("not running on a Hetzner Cloud server; metadata unavailable: %w", mErr)
  }
  return "", err
}

When it happens

Trigger: metadata.NewClient().InstanceID() fails: code running outside a Hetzner server (laptop, CI), metadata service unreachable/firewalled, or the HTTP request timed out.

Common situations: Running kOps verifier/bootstrap logic locally for debugging; running on a non-Hetzner node or inside a container where the link-local metadata address isn't routable; Hetzner metadata service hiccup.

Related errors

• %s is required
• failed to convert server ID %q to int: %w
• failed to get info for server %q: %w
• failed to find network %q: %w
• unable to fetch metadata: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f3c5bbaeab84b910. Report an issue: GitHub.