kubernetes/kops · error

%s is required

Error message

%s is required

What it means

NewHetznerVerifier requires the HCLOUD_TOKEN environment variable to construct an authenticated hcloud client. If it's empty, construction fails immediately. Without a token the verifier cannot query the Hetzner API to validate node bootstrap tokens.

Source

Thrown at upup/pkg/fi/cloudup/hetzner/verifier.go:48

	"k8s.io/kops/pkg/bootstrap"
	"k8s.io/kops/pkg/wellknownports"
	"k8s.io/kops/upup/pkg/fi/cloudup/hetzner/hetznermetadata"
)

type HetznerVerifierOptions struct {
}

type hetznerVerifier struct {
	opt    HetznerVerifierOptions
	client *hcloud.Client
}

var _ bootstrap.Verifier = (*hetznerVerifier)(nil)

func NewHetznerVerifier(opt *HetznerVerifierOptions) (bootstrap.Verifier, error) {
	hcloudToken := os.Getenv("HCLOUD_TOKEN")
	if hcloudToken == "" {
		return nil, fmt.Errorf("%s is required", "HCLOUD_TOKEN")
	}

	opts := []hcloud.ClientOption{
		hcloud.WithToken(hcloudToken),
		hcloud.WithApplication("kops", version.Version),
	}
	hcloudClient := hcloud.NewClient(opts...)

	return &hetznerVerifier{
		opt:    *opt,
		client: hcloudClient,
	}, nil
}

func (h hetznerVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*bootstrap.VerifyResult, error) {
	if !strings.HasPrefix(token, hetznermetadata.HetznerAuthenticationTokenPrefix) {
		return nil, bootstrap.ErrNotThisVerifier
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Export a valid Hetzner API token: `export HCLOUD_TOKEN=<token>` and restart the verifier.
2. Check the service unit/config that launches the verifier includes HCLOUD_TOKEN.
3. Verify the token is non-empty and valid against the Hetzner API.
4. Confirm you're not confusing HCLOUD_TOKEN with other provider env vars.

Example fix

// before
$ kops-hetzner-verifier
// after
$ export HCLOUD_TOKEN=$(cat /etc/hetzner/token)
$ kops-hetzner-verifier

if os.Getenv("HCLOUD_TOKEN") == "" {
  return fmt.Errorf("HCLOUD_TOKEN must be set before starting the verifier")
}

When it happens

Trigger: The kops verifier command is started without HCLOUD_TOKEN set (or set to an empty string).

Common situations: Deploying nodeup/bootstrap verifier without sourcing the env file; systemd unit missing Environment=HCLOUD_TOKEN; token variable name typo.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• DIGITALOCEAN_ACCESS_TOKEN is required
• DIGITALOCEAN_ACCESS_TOKEN is required
• failed to retrieve server ID: %w
• failed to convert server ID %q to int: %w
• failed to get info for server %q: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d61b838def7637ae. Report an issue: GitHub.