hetzner cloud provider currently supports only one zone (loc

Error message

hetzner cloud provider currently supports only one zone (location)

What it means

During `kops create cluster`, setupZones validates the requested --zones list per cloud provider. Hetzner Cloud locations are the unit of deployment and kOps currently models a Hetzner cluster as living in exactly one zone (location). If more than one zone is passed, this error is returned to abort cluster creation rather than silently creating a misconfigured multi-location cluster.

Source

Thrown at upup/pkg/fi/cloudup/new_cluster.go:811

		// For Akamai (Linode) we pass regions via --zones.
		region := opt.Zones[0]
		subnet := model.FindSubnet(cluster, region)

		if subnet == nil {
			subnet = &api.ClusterSubnetSpec{
				Name:   region,
				Region: region,
				Zone:   region,
			}
			cluster.Spec.Networking.Subnets = append(cluster.Spec.Networking.Subnets, *subnet)
		}
		zoneToSubnetsMap[region] = append(zoneToSubnetsMap[region], subnet)
		return zoneToSubnetsMap, nil

	case api.CloudProviderHetzner:
		if len(opt.Zones) > 1 {
			return nil, fmt.Errorf("hetzner cloud provider currently supports only one zone (location)")
		}
		// TODO(hakman): Add customizations for Hetzner Cloud

	case api.CloudProviderAzure:
		// On Azure, subnets are regional - we create one per region, not per zone
		for _, zoneName := range allZones.List() {
			location, err := azure.ZoneToLocation(zoneName)
			if err != nil {
				return nil, err
			}

			// We create default subnets named the same as the cluster
			subnetName := cluster.Name

			subnet := model.FindSubnet(cluster, subnetName)
			if subnet == nil {
				subnet = &api.ClusterSubnetSpec{
					Name:   subnetName,

View on GitHub (pinned to 4c8573c808)

Solutions

Pass exactly one Hetzner location, e.g. --zones fsn1 (valid: fsn1, nbg1, hel1, ash, hil).
Remove the extra zones from the --zones flag or the cluster spec's subnets/zones list.
If multi-AZ HA is required, choose a provider that supports multiple zones (AWS, GCE, Azure) instead of Hetzner.

Example fix

// before
kops create cluster --cloud hetzner --zones fsn1,hel1 mycluster.k8s.local
// after
kops create cluster --cloud hetzner --zones fsn1 mycluster.k8s.local

Defensive patterns

Strategy: validation

Validate before calling

zones := strings.Split(*zonesFlag, ",")
if cloud == "hetzner" && len(zones) > 1 {
    return fmt.Errorf("hetzner supports exactly one zone; got %q", zones)
}

Prevention

Hardcode the single --zones value for Hetzner clusters in scripts/templates.
Split comma-joined zone strings and assert len==1 before invoking kops.
Document the Hetzner one-location limitation wherever multi-zone flags are templated.

When it happens

Trigger: Running `kops create cluster --cloud hetzner --zones fsn1,hel1 ...` (or any --zones value containing a comma, producing >1 zone) while targeting CloudProviderHetzner.

Common situations: Users coming from AWS/GCP habitually pass multiple zones for HA; copy-pasted commands from AWS docs; scripts that build the --zones flag dynamically and add a second location for Hetzner.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/620fd9e7543ed775. Report an issue: GitHub.