{"record":{"id":"74580e4be515fda3","repo":"kubernetes/kops","slug":"error-fetching-dns-hostedzone-q-v","errorCode":null,"errorMessage":"error fetching DNS HostedZone %q: %v","messagePattern":"error fetching DNS HostedZone %q: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnszone.go","lineNumber":117,"sourceCode":"\t// Avoid spurious changes\n\tactual.Lifecycle = e.Lifecycle\n\n\treturn actual, nil\n}\n\nfunc (e *DNSZone) findExisting(ctx context.Context, cloud awsup.AWSCloud) (*route53.GetHostedZoneOutput, error) {\n\tfindID := \"\"\n\tif e.ZoneID != nil {\n\t\trequest := &route53.GetHostedZoneInput{\n\t\t\tId: e.ZoneID,\n\t\t}\n\n\t\tresponse, err := cloud.Route53().GetHostedZone(ctx, request)\n\t\tif err != nil {\n\t\t\tif awsup.AWSErrorCode(err) == \"NoSuchHostedZone\" {\n\t\t\t\treturn nil, nil\n\t\t\t} else {\n\t\t\t\treturn nil, fmt.Errorf(\"error fetching DNS HostedZone %q: %v\", findID, err)\n\t\t\t}\n\t\t} else {\n\t\t\treturn response, nil\n\t\t}\n\t}\n\n\tfindName := fi.ValueOf(e.DNSName)\n\tif findName == \"\" {\n\t\treturn nil, nil\n\t}\n\tif !strings.HasSuffix(findName, \".\") {\n\t\tfindName += \".\"\n\t}\n\trequest := &route53.ListHostedZonesByNameInput{\n\t\tDNSName: aws.String(findName),\n\t}\n\n\tresponse, err := cloud.Route53().ListHostedZonesByName(ctx, request)","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnszone.go#L99-L135","documentation":"Wraps any failure from the Route53 GetHostedZone call made by DNSZone.findExisting when kOps looks up an existing hosted zone by the task's ZoneID. Only the NoSuchHostedZone error is treated as 'zone absent'; every other API failure (auth, throttling, network, malformed ID) is wrapped in this message. Note findID is always empty here (a latent bug), so %q prints \"\".","triggerScenarios":"Route53 GetHostedZone returns an unexpected error while resolving e.ZoneID during Find or RenderTerraform: invalid/expired AWS credentials, IAM missing route53:GetHostedZone, API throttling, network failure, or a ZoneID value with invalid format (Route53 InvalidInput / InvalidDomainName).","commonSituations":"Cluster spec references a zone ID that was deleted in another account/region; IAM policy lacking route53:GetHostedZone; AWS API throttling during large reconcile runs; copying a zone ID without the /hostedzone/ prefix.","solutions":["Check the wrapped %v cause: fix IAM permissions (route53:GetHostedZone) or credentials if AccessDenied/ auth error","If throttling, retry after backoff or reduce concurrent kOps operations","Verify the ZoneID in the cluster spec matches an existing zone (aws route53 get-hosted-zone --id ...)","If the zone no longer exists intentionally, clear e.ZoneID so findExisting falls back to name-based lookup (NoSuchHostedZone is already handled as nil,nil)","Ensure zone ID includes the /hostedzone/ prefix as returned by the API"],"exampleFix":"// before\nreturn nil, fmt.Errorf(\"error fetching DNS HostedZone %q: %v\", findID, err)\n// after\nreturn nil, fmt.Errorf(\"error fetching DNS HostedZone by id %q: %v\", aws.ToString(e.ZoneID), err)","handlingStrategy":"try-catch","validationCode":"zoneID := aws.ToString(e.ZoneID)\nif zoneID != \"\" {\n    _, err := cloud.Route53().GetHostedZone(ctx, &route53.GetHostedZoneInput{Id: aws.String(zoneID)})\n    if err != nil && awsup.AWSErrorCode(err) != \"NoSuchHostedZone\" {\n        return fmt.Errorf(\"precheck: cannot read hosted zone %s: %w\", zoneID, err)\n    }\n}","typeGuard":"func isAuthError(err error) bool {\n    code := awsup.AWSErrorCode(err)\n    return code == \"AccessDenied\" || code == \"AuthFailure\" || code == \"UnauthorizedOperation\"\n}","tryCatchPattern":"resp, err := cloud.Route53().GetHostedZone(ctx, req)\nif err != nil {\n    if awsup.AWSErrorCode(err) == \"NoSuchHostedZone\" {\n        return nil, nil // zone gone: treat as absent\n    }\n    if awsup.AWSErrorCode(err) == \"Throttling\" {\n        return nil, retryAfterBackoff(ctx, req)\n    }\n    return nil, fmt.Errorf(\"error fetching DNS HostedZone by id %q: %w\", aws.ToString(req.Id), err)\n}","preventionTips":["Grant the kOps IAM role route53:GetHostedZone and route53:ListHostedZones*","Store the full zone ID (with /hostedzone/ prefix) exactly as returned by the API","Verify zone IDs with `aws route53 get-hosted-zones` before referencing them in the cluster spec","Prefer explicit ZoneID over name-only matching to avoid ambiguous lookups"],"tags":["aws","route53","dns","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}