{"record":{"id":"3bead41ce79e664a","repo":"kubernetes/kops","slug":"error-querying-for-dns-support-v","errorCode":null,"errorMessage":"error querying for dns support: %v","messagePattern":"error querying for dns support: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/vpc.go","lineNumber":131,"sourceCode":"\t\t}\n\n\t\tpool := aws.ToString(association.Ipv6Pool)\n\t\tif pool == \"Amazon\" {\n\t\t\tactual.AmazonIPv6 = aws.Bool(true)\n\t\t\tactual.IPv6CIDR = association.Ipv6CidrBlock\n\t\t\te.IPv6CIDR = association.Ipv6CidrBlock\n\t\t\tbreak\n\t\t} else if actual.IPv6CIDR == nil {\n\t\t\tactual.IPv6CIDR = association.Ipv6CidrBlock\n\t\t\te.IPv6CIDR = association.Ipv6CidrBlock\n\t\t}\n\t}\n\n\tif actual.ID != nil {\n\t\trequest := &ec2.DescribeVpcAttributeInput{VpcId: actual.ID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport}\n\t\tresponse, err := cloud.EC2().DescribeVpcAttribute(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error querying for dns support: %v\", err)\n\t\t}\n\t\tactual.EnableDNSSupport = response.EnableDnsSupport.Value\n\t}\n\n\tif actual.ID != nil {\n\t\trequest := &ec2.DescribeVpcAttributeInput{VpcId: actual.ID, Attribute: ec2types.VpcAttributeNameEnableDnsHostnames}\n\t\tresponse, err := cloud.EC2().DescribeVpcAttribute(ctx, request)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error querying for dns support: %v\", err)\n\t\t}\n\t\tactual.EnableDNSHostnames = response.EnableDnsHostnames.Value\n\t}\n\n\t// Prevent spurious comparison failures\n\tactual.Shared = e.Shared\n\tif e.ID == nil {\n\t\te.ID = actual.ID\n\t}","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/vpc.go#L113-L149","documentation":"VPC.Find additionally queries DescribeVpcAttribute for enableDnsSupport (and dnsHostnames) to populate the actual state, wrapping any API failure with this message. The VPC was found, but its DNS-support attribute could not be read.","triggerScenarios":"Find on an existing VPC where DescribeVpcAttribute errors: missing ec2:DescribeVpcAttribute permission, throttling, VPC deleted concurrently between DescribeVpcs and this call, or invalid VPC ID.","commonSituations":"IAM policy allows DescribeVpcs but not DescribeVpcAttribute; AWS throttling during big applies; race with VPC deletion by another operator/pipeline.","solutions":["Add ec2:DescribeVpcAttribute to the kops IAM policy","Check the wrapped %v cause; re-run after transient errors","If the VPC was deleted concurrently, clean up cluster state (kops delete cluster) and recreate"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// pre-flight permission check\n// aws iam simulate-principal-policy --policy-source-arn <role> --action-names ec2:DescribeVpcAttribute","typeGuard":null,"tryCatchPattern":"if err := kopsUpdate(); err != nil && strings.Contains(err.Error(), \"error querying for dns support\") {\n  var ae smithy.APIError\n  if errors.As(err, &ae) && ae.ErrorCode() == \"ThrottlingException\" {\n    return retryAfter(backoff)\n  }\n  return fmt.Errorf(\"grant ec2:DescribeVpcAttribute to the kops role: %w\", err)\n}","preventionTips":["Grant ec2:DescribeVpcAttribute alongside DescribeVpcs in IAM","Apply retry/backoff for throttling","Avoid concurrent operators deleting the same VPC mid-apply","Validate EnableDNSSupport expectations in the cluster spec before apply"],"tags":["aws","ec2","vpc","dns","attribute-query"],"backgroundTag":"aws-api-describe-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}