Hetzner provider: serverLabels in HCLOUD_CLUSTER_CONFIG not applied to new servers (v1.32)

[artotor]

Description

When using HCLOUD_CLUSTER_CONFIG with serverLabels in a nodeConfig, the cluster-autoscaler Hetzner cloud provider does not apply these as Hetzner Cloud server labels to newly provisioned servers. Only the implicit hcloud/node-group=<pool-name> label is set.

Environment

• cluster-autoscaler version: registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.0
• Cloud provider: hetzner
• Kubernetes: k3s v1.34.6+k3s1
• HCLOUD_CLUSTER_CONFIG schema includes serverLabels per nodeConfig

Steps to reproduce

1. Configure HCLOUD_CLUSTER_CONFIG as base64-encoded JSON:

   {
     "imagesForArch": {"amd64": "ubuntu-24.04"},
     "nodeConfigs": {
       "workers": {
         "cloudInit": "<base64>",
         "labels": {"role": "worker"},
         "serverLabels": {"archie-cluster": "staging"}
       }
     }
   }

2. Trigger a scale-up event by creating a pod with matching nodeSelector that cannot fit existing nodes.

3. Observe the new server in Hetzner Cloud:

   hcloud server describe <new-server-id> --output=json | jq '.labels'

Expected

{
  "hcloud/node-group": "workers",
  "archie-cluster": "staging"
}

Actual

{
  "hcloud/node-group": "workers"
}

The archie-cluster label from serverLabels is missing. The Kubernetes node labels (labels field) are applied correctly via --node-label=role=worker in the agent install command.

Impact

This breaks the apply_to.label_selector pattern for Hetzner Cloud Firewalls. The recommended way to attach a firewall to autoscaler-provisioned nodes is via label_selector, but if serverLabels are not applied, every new node lacks the label and is outside the firewall scope. Workaround requires manual hcloud server add-label after each scale-up, defeating autoscaling.

Workaround

Manually apply the label post-provisioning:

hcloud server add-label <server-id> archie-cluster=<env>

This is operationally painful for autoscaling workloads.

Related code

The provider's hetzner_node_group.go (search for serverLabels or ServerLabels). Possible that cloudInitDefinition.ServerLabels is parsed but not passed to client.Server.Create opts.

Acceptance criteria

• New servers created by the autoscaler carry all key-value pairs from serverLabels of their nodeConfig as Hetzner Cloud labels.
• Existing hcloud/node-group label continues to be set.
• Documented in the Hetzner provider README.

Happy to test a fix against a staging cluster if a PR is opened.

[k8s-ci-robot]

This issue is currently awaiting triage.

If SIG Autoscaling contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[adrianmoisey]

/area cluster-autoscaler