{"record":{"id":"783d7738642c45b6","repo":"kubernetes/kops","slug":"error-listing-dns-hostedzones-v","errorCode":null,"errorMessage":"error listing DNS HostedZones: %v","messagePattern":"error listing DNS HostedZones: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnszone.go","lineNumber":137,"sourceCode":"\t\t} else {\n\t\t\treturn response, nil\n\t\t}\n\t}\n\n\tfindName := fi.ValueOf(e.DNSName)\n\tif findName == \"\" {\n\t\treturn nil, nil\n\t}\n\tif !strings.HasSuffix(findName, \".\") {\n\t\tfindName += \".\"\n\t}\n\trequest := &route53.ListHostedZonesByNameInput{\n\t\tDNSName: aws.String(findName),\n\t}\n\n\tresponse, err := cloud.Route53().ListHostedZonesByName(ctx, request)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error listing DNS HostedZones: %v\", err)\n\t}\n\n\tvar zones []route53types.HostedZone\n\tfor _, zone := range response.HostedZones {\n\t\tif aws.ToString(zone.Name) == findName && zone.Config.PrivateZone == fi.ValueOf(e.Private) {\n\t\t\tzones = append(zones, zone)\n\t\t}\n\t}\n\n\tif len(zones) == 0 {\n\t\treturn nil, nil\n\t} else if len(zones) != 1 {\n\t\treturn nil, fmt.Errorf(\"found multiple hosted zones matched name %q\", findName)\n\t} else {\n\t\trequest := &route53.GetHostedZoneInput{\n\t\t\tId: zones[0].Id,\n\t\t}\n","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnszone.go#L119-L155","documentation":"Wraps any failure from Route53 ListHostedZonesByName during name-based lookup of an existing DNSZone in findExisting (used when the task has no ZoneID). The zone-matching logic never runs, so kOps may fall through to creating a duplicate zone once the API recovers.","triggerScenarios":"cloud.Route53().ListHostedZonesByName returns an error: AccessDenied (IAM lacks route53:ListHostedZonesByName), throttling (Throttling/RequestLimitExceeded), invalid DNSName filter format, network/connectivity failure.","commonSituations":"Read-only IAM role missing ListHostedZonesByName; rate limiting when reconciling many clusters; DNSName misconfigured (e.g. containing invalid characters); transient AWS outage.","solutions":["Read the wrapped %v cause; if AccessDenied add route53:ListHostedZonesByName to the IAM policy","If Throttling, retry with exponential backoff / reduce concurrency","Validate e.DNSName is a well-formed DNS name before running","Retry the kops command after confirming `aws route53 list-hosted-zones-by-name --dns-name <name>` succeeds"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"findName := strings.TrimSuffix(fi.ValueOf(e.DNSName), \".\") + \".\"\nif net.ParseIP(findName) != nil || !strings.Contains(strings.TrimSuffix(findName, \".\"), \".\") {\n    return fmt.Errorf(\"invalid DNSName %q for hosted zone lookup\", findName)\n}\nif _, err := cloud.Route53().ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(findName)}); err != nil {\n    return fmt.Errorf(\"precheck listing hosted zones failed: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"response, err := cloud.Route53().ListHostedZonesByName(ctx, request)\nif err != nil {\n    if awsup.AWSErrorCode(err) == \"Throttling\" {\n        return nil, retryWithBackoff(ctx, request)\n    }\n    return nil, fmt.Errorf(\"error listing DNS HostedZones: %w\", err)\n}","preventionTips":["Ensure the executor's IAM policy includes route53:ListHostedZonesByName","Keep DNSName lowercase, fully-qualified, no wildcards","Avoid running many concurrent kops reconciles against one account to prevent throttling","Run `aws route53 list-hosted-zones` as an IAM/permissions smoke test before kops"],"tags":["aws","route53","dns","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}