fix(hetzner): use native /hetzner/v1/ metadata URLs (EC2-compat removed 2026-08-01) - #329
Open
ocalzi wants to merge 1 commit into
Open
fix(hetzner): use native /hetzner/v1/ metadata URLs (EC2-compat removed 2026-08-01)#329ocalzi wants to merge 1 commit into
ocalzi wants to merge 1 commit into
Conversation
…ed 2026-08-01)
Hetzner removed all EC2-compatible metadata routes on 2026-08-01:
/latest/meta-data/, /latest/meta-data/{key}, /latest/user-data
/2009-04-04/meta-data, /2009-04-04/meta-data/{key}, /2009-04-04/user-data
provider_hetzner.go shared metaDataURL/userDataURL constants with
provider_aws.go (EC2-compat paths). As a result, Probe() fails on every
Hetzner server since Aug 1 and no cloud-config is applied — Kairos nodes
install without k3s config, SSH keys, or hostname.
Changes:
- Add hetznerMetaDataURL (http://169.254.169.254/hetzner/v1/metadata/)
and hetznerUserDataURL (http://169.254.169.254/hetzner/v1/userdata)
as Hetzner-native constants, decoupled from the AWS EC2-compat ones
- Update Probe() and all Extract() fetches to use these constants
- Remove local-ipv4 flat-key fetch (moved to private-networks YAML in
native API, no flat key equivalent)
- Remove handleSSH() / public-keys fetch (public-keys endpoint absent
from Hetzner native API; SSH keys belong in cloud-config users block)
New base URL confirmed by hetznercloud/hcloud-go official metadata client:
https://github.com/hetznercloud/hcloud-go/blob/main/hcloud/metadata/client.go
Hetzner changelog:
https://docs.hetzner.cloud/changelog#2026-08-01-removed-metadata-routes
Downstream impact: kairos-io/kairos-agent embeds yip; kairos-io/kairos
bundles the agent into ISOs. All Kairos ISOs on Hetzner are affected until
kairos-agent bumps this fix and a new ISO is released.mudler
reviewed
Aug 24, 2026
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Hetzner removed all EC2-compatible metadata routes on 2026-08-01 (announced 2026-06-30):
/latest/meta-data,/latest/meta-data/{key},/latest/user-data/2009-04-04/meta-data,/2009-04-04/meta-data/{key},/2009-04-04/user-dataReference: https://docs.hetzner.cloud/changelog#2026-08-01-removed-metadata-routes
provider_hetzner.gosharedmetaDataURLanduserDataURLconstants withprovider_aws.go— both pointing to EC2-compat paths. As a result:Probe()callshttp://169.254.169.254/latest/meta-data/hostname→ non-200 → returnsfalseKairos nodes install with no k3s config, no hostname, no SSH keys.
Fix
Add Hetzner-native URL constants decoupled from the AWS provider:
New base URL confirmed by the official
hetznercloud/hcloud-gometadata client:https://github.com/hetznercloud/hcloud-go/blob/main/hcloud/metadata/client.go
(
const Endpoint = "http://169.254.169.254/hetzner/v1/metadata")Removed endpoints
local-ipv4: No flat key in native API. Private IP is now in theprivate-networksYAML blob at/hetzner/v1/metadata/private-networks. Removed fetch; no known Kairos component readsConfigPath/local_ipv4.public-keys: Not present in Hetzner native API (absent fromhcloud-goclient).handleSSH()removed. SSH keys must be provided viausers.[].ssh_authorized_keysin cloud-config — which is the correct approach and already the default for Kairos-provisioned servers.Downstream impact
This fix needs to propagate to:
kairos-io/kairos-agent— embeds yip; needs a dep bumpkairos-io/kairos— bundles kairos-agent into ISOs; needs a new releaseAll Kairos ISO versions built before this fix land in kairos-agent are broken on Hetzner post-2026-08-01.