{"record":{"id":"7c4d8bc69d1cb12f","repo":"kubernetes/kops","slug":"error-getting-gce-dns-zone-data-v","errorCode":null,"errorMessage":"error getting GCE DNS zone data %v","messagePattern":"error getting GCE DNS zone data (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":1347,"sourceCode":"\t}\n\treturn false\n}\n\nfunc (d *clusterDiscoveryGCE) listGCEDNSZone() ([]*resources.Resource, error) {\n\tvar resourceTrackers []*resources.Resource\n\n\tmanagedZones, err := d.gceCloud.CloudDNS().ManagedZones().List(d.gceCloud.Project())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting GCE DNS zones %v\", err)\n\t}\n\n\tfor _, zone := range managedZones {\n\t\tif !strings.HasSuffix(d.clusterDNSName(), zone.DnsName) {\n\t\t\tcontinue\n\t\t}\n\t\trrsets, err := d.gceCloud.CloudDNS().ResourceRecordSets().List(d.gceCloud.Project(), zone.Name)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error getting GCE DNS zone data %v\", err)\n\t\t}\n\n\t\tfor _, record := range rrsets {\n\t\t\t// adapted from AWS implementation\n\t\t\tif record.Type != \"A\" {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif d.isKopsManagedDNSName(record.Name) {\n\t\t\t\tresource := resources.Resource{\n\t\t\t\t\tName:         record.Name,\n\t\t\t\t\tID:           record.Name,\n\t\t\t\t\tType:         typeDNSRecord,\n\t\t\t\t\tGroupDeleter: deleteDNSRecords,\n\t\t\t\t\tGroupKey:     zone.Name,\n\t\t\t\t\tObj:          record,\n\t\t\t\t}\n\t\t\t\tresourceTrackers = append(resourceTrackers, &resource)","sourceCodeStart":1329,"sourceCodeEnd":1365,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L1329-L1365","documentation":"Returned by listGCEDNSZone when CloudDNS().ResourceRecordSets().List fails for a specific managed zone after zones were listed successfully. kops needs the A records to identify cluster-owned DNS entries during discovery. The wrapped error carries the true cause from the Google Cloud DNS API.","triggerScenarios":"resourceRecordSets.list for (project, zone.Name) fails: the zone was deleted concurrently, transient API error, rate limit (per-zone RRSet list is quota heavy), or permissions allow zones.list but not RRSet listing.","commonSituations":"Concurrent deletion/renaming of the DNS zone while kops is scanning; hitting Cloud DNS QPS quotas in projects with many zones; IAM policy drift after zones listed fine (unlikely but possible with cached tokens); network interruption mid-discovery.","solutions":["Re-run kops delete cluster; if transient (429/5xx) it often succeeds on retry after a short wait.","Check IAM: the service account needs dns.reader (or dns.resourceRecordSets.list) on the project.","Run gcloud dns record-sets list --zone <zone> --project <project> to see the raw error and confirm zone accessibility.","If a specific zone is being deleted concurrently, wait for that operation to finish before running discovery."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"zones, err := dnsService.ManagedZones.List(project).Do()\nif err != nil {\n    return fmt.Errorf(\"cannot reach Cloud DNS API: %w\", err)\n}\nfor _, z := range zones.ManagedZones {\n    if _, err := dnsService.ResourceRecordSets.List(project, z.Name).Do(); err != nil {\n        return fmt.Errorf(\"RRSet listing not permitted for zone %s: %w\", z.Name, err)\n    }\n}","typeGuard":"var apiErr *googleapi.Error\nif errors.As(err, &apiErr) && (apiErr.Code == 429 || apiErr.Code >= 500) {\n    // transient: safe to retry with backoff\n}","tryCatchPattern":"rrsets, err := c.CloudDNS().ResourceRecordSets().List(project, zoneName)\nvar apiErr *googleapi.Error\nif errors.As(err, &apiErr) && (apiErr.Code == 429 || apiErr.Code >= 500) {\n    time.Sleep(backoff)\n    rrsets, err = c.CloudDNS().ResourceRecordSets().List(project, zoneName)\n}","preventionTips":["Avoid running discovery during concurrent zone mutations.","Add retry with exponential backoff for 429/5xx Cloud DNS responses.","Verify dns.resourceRecordSets.list permission before delete operations.","Check status.cloud.google.com for DNS API incidents."],"tags":["gce","dns","gcp","cloud-provider"],"backgroundTag":"gcp-api-auth-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}