{"record":{"id":"063bf4ae15d43204","repo":"kubernetes/kops","slug":"error-building-dns-scope-v-063bf4","errorCode":null,"errorMessage":"error building dns scope: %v","messagePattern":"error building dns scope: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dns-controller/pkg/watchers/service.go","lineNumber":47,"sourceCode":"\t\"k8s.io/klog/v2\"\n\t\"k8s.io/kops/dns-controller/pkg/dns\"\n\t\"k8s.io/kops/dns-controller/pkg/util\"\n\t\"k8s.io/kops/upup/pkg/fi/utils\"\n)\n\n// ServiceController watches for services with dns annotations\ntype ServiceController struct {\n\tutil.Stoppable\n\tclient    kubernetes.Interface\n\tnamespace string\n\tscope     dns.Scope\n}\n\n// NewServiceController creates a ServiceController\nfunc NewServiceController(client kubernetes.Interface, dns dns.Context, namespace string) (*ServiceController, error) {\n\tscope, err := dns.CreateScope(\"service\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building dns scope: %v\", err)\n\t}\n\tc := &ServiceController{\n\t\tclient:    client,\n\t\tnamespace: namespace,\n\t\tscope:     scope,\n\t}\n\n\treturn c, nil\n}\n\n// Run starts the ServiceController.\nfunc (c *ServiceController) Run() {\n\tklog.Infof(\"starting service controller\")\n\n\tstopCh := c.StopChannel()\n\tgo c.runWatcher(stopCh)\n\n\t<-stopCh","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dns-controller/pkg/watchers/service.go#L29-L65","documentation":"NewServiceController returns \"error building dns scope: %v\" when dns.CreateScope(\"service\") fails while constructing the ServiceController. The scope is the provider-backed record namespace for service DNS records; without it the controller cannot be instantiated. The underlying provider error (auth, zone lookup, provider API failure) is wrapped in the message.","triggerScenarios":"Calling NewServiceController(client, dnsContext, namespace) where dns.Context.CreateScope(\"service\") returns an error from the dnsprovider implementation - commonly invalid provider configuration, unavailable hosted zone, or cloud API auth failure during zone initialization.","commonSituations":"Incorrect --dns provider flag; Route53/AzureDNS/GoogleDNS credentials missing or insufficient; hosted zone deleted or not yet created in a new cluster; dns context built from a failed provider init.","solutions":["Inspect the wrapped '%v' error for the provider-level cause.","Validate the DNS provider name and zone configuration flags passed to dns-controller.","Verify cloud DNS API credentials and permissions for the controller identity.","Recreate the hosted zone if it was removed, then restart dns-controller."],"exampleFix":"// before: wrong provider name\n--dns=route53aaa\n// after\n--dns=aws-route53","handlingStrategy":"validation","validationCode":"// Go: ensure the dns context and provider are functional before NewServiceController\nif dnsContext == nil {\n    return nil, errors.New(\"dns context must be initialized before NewServiceController\")\n}\nif _, err := dnsContext.CreateScope(\"service\"); err != nil {\n    return fmt.Errorf(\"provider scope preflight failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"sc, err := NewServiceController(client, dnsContext, namespace)\nif err != nil {\n    if strings.Contains(err.Error(), \"error building dns scope\") {\n        klog.Errorf(\"DNS provider/zone misconfigured: %v\", err)\n        return err\n    }\n    return err\n}","preventionTips":["Confirm the --dns provider name is a registered provider.","Verify hosted zone existence and cloud DNS credentials before rollout.","Initialize provider and context prior to watcher construction."],"tags":["dns-controller","dns-provider","configuration"],"backgroundTag":"dns-scope-init-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}