kubernetes/kops · error

%s is required

Error message

%s is required

What it means

The Hetzner node identity provider refuses to start when the HCLOUD_TOKEN environment variable is empty, because no Hetzner Cloud API client can be constructed without an auth token. New() is the constructor for the identifier used by kops' node-authorizer/node controller.

Source

Thrown at pkg/nodeidentity/hetzner/identify.go:53

	"k8s.io/kops/upup/pkg/fi/cloudup/hetzner"
)

const (
	cacheTTL = 60 * time.Minute
)

// nodeIdentifier identifies a node from Hetzner Cloud
type nodeIdentifier struct {
	client       *hcloud.Client
	cache        expirationcache.Store
	cacheEnabled bool
}

// New creates and returns a nodeidentity.Identifier for Nodes running on Hetzner Cloud
func New(cacheNodeidentityInfo bool) (nodeidentity.Identifier, error) {
	hcloudToken := os.Getenv("HCLOUD_TOKEN")
	if hcloudToken == "" {
		return nil, fmt.Errorf("%s is required", "HCLOUD_TOKEN")
	}
	opts := []hcloud.ClientOption{
		hcloud.WithToken(hcloudToken),
		hcloud.WithApplication("kops", version.Version),
	}
	hcloudClient := hcloud.NewClient(opts...)

	return &nodeIdentifier{
		client:       hcloudClient,
		cache:        expirationcache.NewTTLStore(stringKeyFunc, cacheTTL),
		cacheEnabled: cacheNodeidentityInfo,
	}, nil
}

// IdentifyNode queries Hetzner Cloud for the node identity information
func (i *nodeIdentifier) IdentifyNode(ctx context.Context, node *corev1.Node) (*nodeidentity.Info, error) {
	providerID := node.Spec.ProviderID
	if providerID == "" {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set HCLOUD_TOKEN in the kops-controller pod spec (from a Kubernetes Secret)
2. Verify the token is a valid Hetzner Cloud API token with read permission
3. Recreate the pod after fixing the env so the new value is picked up

Example fix

// before
// kops-controller pod without HCLOUD_TOKEN -> crash on startup
// after (pod env)
env:
- name: HCLOUD_TOKEN
  valueFrom:
    secretKeyRef:
      name: kops-controller
      key: hcloud-token

if os.Getenv("HCLOUD_TOKEN") == "" {
  return fmt.Errorf("HCLOUD_TOKEN is required")
}

id, err := nodeidentityhetzner.New(cache)
if err != nil {
  log.Fatalf("hetzner identity init: %v", err) // fail fast at startup
}

When it happens

Trigger: New(cacheNodeidentityInfo bool) runs with os.Getenv("HCLOUD_TOKEN") == "" — i.e., the kops controller (e.g., kops-controller DaemonSet) was deployed without the HCLOUD_TOKEN env var set.

Common situations: kops-controller manifest edited and the env var/secret reference dropped; secret created in the wrong namespace; typo in env var name; upgrading kops-controller without re-applying the secret.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• clientset is not initialized
• must specify cloud
• identifier for cloud %q not implemented
• kOps IPAM controller is not supported on cloud %q
• load balancer %s(%d) is not public

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/c91ed486d9c25bad. Report an issue: GitHub.