{"record":{"id":"33187a93c1725fa2","repo":"kubernetes/kops","slug":"no-suitable-zone-found-for-q","errorCode":null,"errorMessage":"no suitable zone found for %q","messagePattern":"no suitable zone found for %q","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"dns-controller/pkg/dns/dnscontroller.go","lineNumber":504,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error querying resource records for zone %q: %v\", zone.Name(), err)\n\t\t}\n\n\t\to.recordsCache[key] = rrs\n\t}\n\n\treturn rrs, nil\n}\n\nfunc (o *dnsOp) deleteRecords(k recordKey) error {\n\tklog.V(2).Infof(\"Deleting all records for %s\", k)\n\n\tfqdn := EnsureDotSuffix(k.FQDN)\n\n\tzone := o.findZone(fqdn)\n\tif zone == nil {\n\t\t// TODO: Post event into service / pod\n\t\treturn fmt.Errorf(\"no suitable zone found for %q\", fqdn)\n\t}\n\n\t// when DNS provider is aws-route53 or google-clouddns\n\trrs, err := o.listRecords(zone)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error querying resource records for zone %q: %v\", zone.Name(), err)\n\t}\n\n\tcs, err := o.getChangeset(zone)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, rr := range rrs {\n\t\trrName := EnsureDotSuffix(rr.Name())\n\t\tif rrName != fqdn {\n\t\t\tklog.V(8).Infof(\"Skipping delete of record %q (name != %s)\", rrName, fqdn)\n\t\t\tcontinue","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dns-controller/pkg/dns/dnscontroller.go#L486-L522","documentation":"deleteRecords resolves the hosted zone for a record's FQDN via findZone. If no zone in the controller's zone list matches the FQDN suffix, it returns 'no suitable zone found for %q' and skips deletion. The controller only manages records inside zones it can see, so a mismatch between the record's domain and the visible zones triggers this.","triggerScenarios":"deleteRecords for hostname k whose EnsureDotSuffix(k.FQDN) is not a suffix of any zone returned by ListZones: e.g. record 'app.example.org' but the account only holds 'example.com'; or zone filters (--zone/--zoneid) excluded the matching zone.","commonSituations":"Service/ingress annotation uses a FQDN outside the hosted zones; wrong hosted zone in the account; --zone flags restricting the controller; zone deleted/renamed after records were created; typo in annotation domain.","solutions":["Verify the FQDN in the pod/service/ingress annotation matches (is a subdomain of) an actual hosted zone visible to the controller.","Remove or widen --zone/--zoneid flags so the matching zone is included in zone discovery.","Ensure the zone exists and the controller's credentials can list it (route53:ListHostedZones).","Correct the annotation domain (e.g. internal.example.org -> internal.example.com) to the real zone suffix."],"exampleFix":"// before: ingress annotation\nexternal-dns.alpha.kubernetes.io/hostname: app.example.org   // zone example.org not in this account\n// after: point at a hosted zone the controller manages\nexternal-dns.alpha.kubernetes.io/hostname: app.example.com","handlingStrategy":"validation","validationCode":"// before annotating a service/ingress, confirm the FQDN is inside a managed zone\nzones, _ := dnsCache.ListZones(zoneListCacheValidity)\nfqdn := \"app.example.org\"\nvar managed bool\nfor _, z := range zones {\n    if strings.HasSuffix(fqdn, strings.TrimSuffix(z.Name(), \".\")) {\n        managed = true\n    }\n}\nif !managed {\n    klog.Warningf(\"%s is not within any visible hosted zone; record will not be managed\", fqdn)\n}","typeGuard":null,"tryCatchPattern":"if err := deleteRecords(keys); err != nil {\n    if strings.Contains(err.Error(), \"no suitable zone found\") {\n        klog.Warningf(\"orphaned record outside managed zones: %v\", err) // requires manual cleanup\n        return\n    }\n    return err\n}","preventionTips":["Only annotate services/ingresses with FQDNs that are subdomains of hosted zones visible to the controller.","Avoid narrowing --zone/--zoneid flags unless intentional.","After deleting/migrating a zone, clean up records or update annotations.","Validate annotation domains in CI (suffix check against your zone inventory)."],"tags":["dns","zone-mapping","fqdn","dns-controller","configuration"],"backgroundTag":"dns-zone-not-found-for-fqdn","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}