{"record":{"id":"178bb78147739486","repo":"kubernetes/kops","slug":"error-querying-resource-records-for-zone-q-v","errorCode":null,"errorMessage":"error querying resource records for zone %q: %v","messagePattern":"error querying resource records for zone %q: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dns-controller/pkg/dns/dnscontroller.go","lineNumber":487,"sourceCode":"\treturn changeset, nil\n}\n\n// listRecords is a wrapper around listing records, but will cache the results for the duration of the dnsOp\nfunc (o *dnsOp) listRecords(zone dnsprovider.Zone) ([]dnsprovider.ResourceRecordSet, error) {\n\tkey := zone.Name() + \"::\" + zone.ID()\n\n\trrs := o.recordsCache[key]\n\tif rrs == nil {\n\t\trrsProvider, ok := zone.ResourceRecordSets()\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"zone does not support resource records %q\", zone.Name())\n\t\t}\n\n\t\tklog.V(2).Infof(\"Querying all dnsprovider records for zone %q\", zone.Name())\n\t\tvar err error\n\t\trrs, err = rrsProvider.List()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error querying resource records for zone %q: %v\", zone.Name(), err)\n\t\t}\n\n\t\to.recordsCache[key] = rrs\n\t}\n\n\treturn rrs, nil\n}\n\nfunc (o *dnsOp) deleteRecords(k recordKey) error {\n\tklog.V(2).Infof(\"Deleting all records for %s\", k)\n\n\tfqdn := EnsureDotSuffix(k.FQDN)\n\n\tzone := o.findZone(fqdn)\n\tif zone == nil {\n\t\t// TODO: Post event into service / pod\n\t\treturn fmt.Errorf(\"no suitable zone found for %q\", fqdn)\n\t}","sourceCodeStart":469,"sourceCodeEnd":505,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dns-controller/pkg/dns/dnscontroller.go#L469-L505","documentation":"After confirming record-set support, listRecords calls rrsProvider.List() to fetch all records in the zone. A provider error there is wrapped as 'error querying resource records for zone %q: %v'. The result is cached per zone (name::id), so a failure forces re-query on every pass until it succeeds.","triggerScenarios":"rrsProvider.List() errors: API throttling, network timeout to the DNS API, permission denied on record listing, malformed pagination in the provider driver.","commonSituations":"Route53 ThrottlingException with many zones/pods; IAM missing route53:ListResourceRecordSets; transient network outage from the cluster to the DNS API; very large hosted zones hitting driver limits.","solutions":["Inspect the wrapped provider error: throttle/transient errors resolve on the next watcher tick; add backoff or widen the loop interval.","Grant record-listing permissions (route53:ListResourceRecordSets) to the controller identity.","Check network egress/proxy settings from the dns-controller pod to the provider endpoint.","For very large zones, consider scoping the controller with --zone/--zoneid filters to reduce list volume."],"exampleFix":"// before: role can change records but not list them\n//   AccessDenied: route53:ListResourceRecordSets\n// after: add to the controller policy\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"route53:ListResourceRecordSets\"],\n  \"Resource\": [\"arn:aws:route53:::hostedzone/YOURZONEID\"]\n}","handlingStrategy":"retry","validationCode":"// pre-flight IAM check (AWS example)\n// aws route53 list-resource-record-sets --hosted-zone-id ZONEID --max-items 1\n// run from the controller's identity before rollout","typeGuard":null,"tryCatchPattern":"rrs, err := o.listRecords(zone)\nif err != nil {\n    if strings.Contains(err.Error(), \"Throttling\") || strings.Contains(err.Error(), \"timeout\") {\n        time.Sleep(backoff) // transient: retry next tick\n    }\n    return err\n}","preventionTips":["Grant route53:ListResourceRecordSets to the controller identity.","Widen the watcher interval when managing many/large zones to avoid throttling.","Monitor provider API error rates from the controller logs.","Scope with --zone/--zoneid to limit zones listed per pass."],"tags":["dns","dnsprovider","record-listing","throttling","aws"],"backgroundTag":"dns-record-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}