{"record":{"id":"38f0b0ef314f7dc9","repo":"kubernetes/kops","slug":"error-querying-for-dns-zones-v","errorCode":null,"errorMessage":"error querying for DNS zones: %v","messagePattern":"error querying for DNS zones: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dns-controller/pkg/dns/dnscache.go","lineNumber":81,"sourceCode":"\td.mutex.Lock()\n\tdefer d.mutex.Unlock()\n\n\tnow := nanoTime()\n\n\tif d.cachedZones != nil {\n\t\tif (d.cachedZonesTimestamp + validity.Nanoseconds()) > now {\n\t\t\treturn d.cachedZones, nil\n\t\t}\n\t\tklog.V(2).Infof(\"querying all DNS zones (cache expired)\")\n\t} else {\n\t\tklog.V(2).Infof(\"querying all DNS zones (no cached results)\")\n\t}\n\n\tvar allZones []dnsprovider.Zone\n\tfor _, zonesProvider := range d.zonesProviders {\n\t\tzones, err := zonesProvider.List()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error querying for DNS zones: %v\", err)\n\t\t}\n\n\t\tallZones = append(allZones, zones...)\n\t}\n\td.cachedZones = allZones\n\td.cachedZonesTimestamp = now\n\n\treturn allZones, nil\n}\n","sourceCodeStart":63,"sourceCodeEnd":91,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dns-controller/pkg/dns/dnscache.go#L63-L91","documentation":"dnsCache.ListZones refreshes the zone cache by calling List() on each zones provider. If any provider's zone listing call fails (API error, auth failure, network problem), the error is wrapped with this message and returned to the caller (newDNSOp).","triggerScenarios":"A new DNS operation triggers ListZones after cache expiry; the provider's List() call fails due to API credentials, network, rate limiting, or regional endpoint issues.","commonSituations":"Expired or missing cloud credentials (AWS/GCP); network egress blocked to the DNS API; provider API throttling; misconfigured region causing API endpoint errors.","solutions":["Look at the wrapped %v error for the provider-specific cause (auth vs network vs throttle).","Verify cloud credentials (AWS credentials, GCP service account) are present and valid.","Check network connectivity/firewall to the DNS provider API endpoint.","Retry — the cache refreshes on the next operation after the transient failure clears."],"exampleFix":"// before: no AWS creds in env\nAWS_ACCESS_KEY_ID= ./dns-controller ...\n// after\nexport AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-1\n./dns-controller ...","handlingStrategy":"retry","validationCode":"// pre-flight: verify credentials can list zones before starting the controller\nif _, err := zonesProvider.List(); err != nil {\n\treturn fmt.Errorf(\"pre-flight zone list failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"zones, err := dnsCache.ListZones()\nif err != nil {\n\tif isAuthError(err) { renewCredentials() }\n\tif isThrottleError(err) { backoffAndRetry(err) }\n\tklog.Warningf(\"zone listing failed, will retry: %v\", err)\n}","preventionTips":["Refresh cloud credentials automatically (instance roles, workload identity) instead of static keys.","Set up monitoring/alerting on DNS provider API error rates.","Ensure network egress to the DNS provider API from the controller's network."],"tags":["dns","network","cloud-api","dns-controller"],"backgroundTag":"dns-zone-listing-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}