{"record":{"id":"527317f4aa9798f3","repo":"kubernetes/kops","slug":"error-querying-for-zones-v","errorCode":null,"errorMessage":"error querying for zones: %v","messagePattern":"error querying for zones: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dns-controller/pkg/dns/dnscontroller.go","lineNumber":393,"sourceCode":"\t\treturn errors[0]\n\t}\n\n\treturn nil\n}\n\n// dnsOp manages a single dns change; we cache results and state for the duration of the operation\ntype dnsOp struct {\n\tdnsCache     *dnsCache\n\tzones        map[string]dnsprovider.Zone\n\trecordsCache map[string][]dnsprovider.ResourceRecordSet\n\n\tchangesets map[string]dnsprovider.ResourceRecordChangeset\n}\n\nfunc newDNSOp(zoneRules *ZoneRules, dnsCache *dnsCache) (*dnsOp, error) {\n\tzones, err := dnsCache.ListZones(zoneListCacheValidity)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error querying for zones: %v\", err)\n\t}\n\n\t// First we build up a map of all zones by name,\n\t// then we go through and pick the \"correct\" zone for each name\n\tallZoneMap := make(map[string][]dnsprovider.Zone)\n\tfor _, zone := range zones {\n\t\tname := EnsureDotSuffix(zone.Name())\n\t\tallZoneMap[name] = append(allZoneMap[name], zone)\n\t}\n\n\tzoneMap := make(map[string]dnsprovider.Zone)\n\tfor name, zones := range allZoneMap {\n\t\tvar matches []dnsprovider.Zone\n\t\tfor _, zone := range zones {\n\t\t\tif zoneRules.MatchesExplicitly(zone) {\n\t\t\t\tmatches = append(matches, zone)\n\t\t\t}\n\t\t}","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/dns-controller/pkg/dns/dnscontroller.go#L375-L411","documentation":"newDNSOp builds the per-update operation by first listing zones through the dnsCache (ListZones with a validity window). If listing zones fails — provider API error, auth failure, no zones interface — it returns 'error querying for zones: %v'. Both runOnce and RemoveRecordsImmediate depend on this, so a failure blocks all DNS updates and deletions.","triggerScenarios":"dnsCache.ListZones fails: underlying provider's Zones() call errors, credentials invalid, network unreachable, or the provider does not support zone enumeration.","commonSituations":"Expired/missing cloud credentials (AWS keys, GCP service account), VPC without internet egress to the DNS API, wrong --dns= provider flag, IAM missing route53:ListHostedZones.","solutions":["Fix the credentials used by the controller (instance profile / service account) and verify with the cloud CLI from the same environment.","Confirm network egress from the controller pod to the provider DNS API (no blocking NetworkPolicy/NAT misconfig).","Verify the --dns provider flag matches your environment and that IAM permits zone listing (route53:ListHostedZones).","Check the wrapped inner error for the exact provider cause; the cache will retry on the next loop tick."],"exampleFix":"// before: controller service account with no zone-list permission\n//   AccessDenied: not authorized to perform route53:ListHostedZones\n// after: attach read policy to the controller role\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"route53:ListHostedZones\", \"route53:ListHostedZonesByName\", \"route53:GetHostedZone\"],\n  \"Resource\": \"*\"\n}","handlingStrategy":"validation","validationCode":"// pre-flight from the controller's environment\n// aws route53 list-hosted-zones --max-items 1   (or provider equivalent)\n// must succeed before starting the controller\nzones, err := dnsCache.ListZones(zoneListCacheValidity)\nif err != nil {\n    klog.Fatalf(\"zone discovery failed at startup: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"op, err := newDNSOp(zoneRules, dnsCache)\nif err != nil {\n    // inspect wrapped cause: auth vs network vs permission\n    klog.Errorf(\"dns op build failed: %v\", err)\n    return err // let the watcher retry after backoff\n}","preventionTips":["Verify cloud credentials/instance profile/service account before deploying the controller.","Ensure network egress from the pod to the DNS provider API.","Confirm the --dns provider flag matches your cloud and IAM allows zone listing.","Fail fast at startup on zone-list errors rather than crash-looping silently."],"tags":["dns","dns-controller","zone-discovery","authentication"],"backgroundTag":"dns-zone-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}