{"record":{"id":"8d89050b69130b34","repo":"kubernetes/kops","slug":"error-getting-gce-dns-zones-v","errorCode":null,"errorMessage":"error getting GCE DNS zones %v","messagePattern":"error getting GCE DNS zones (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/resources/gce/gce.go","lineNumber":1338,"sourceCode":"\treturn d.clusterName + \".\"\n}\n\nfunc (d *clusterDiscoveryGCE) isKopsManagedDNSName(name string) bool {\n\tprefix := []string{`api`, `api.internal`, `bastion`}\n\tfor _, p := range prefix {\n\t\tif name == p+\".\"+d.clusterDNSName() {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}\n\nfunc (d *clusterDiscoveryGCE) listGCEDNSZone() ([]*resources.Resource, error) {\n\tvar resourceTrackers []*resources.Resource\n\n\tmanagedZones, err := d.gceCloud.CloudDNS().ManagedZones().List(d.gceCloud.Project())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting GCE DNS zones %v\", err)\n\t}\n\n\tfor _, zone := range managedZones {\n\t\tif !strings.HasSuffix(d.clusterDNSName(), zone.DnsName) {\n\t\t\tcontinue\n\t\t}\n\t\trrsets, err := d.gceCloud.CloudDNS().ResourceRecordSets().List(d.gceCloud.Project(), zone.Name)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error getting GCE DNS zone data %v\", err)\n\t\t}\n\n\t\tfor _, record := range rrsets {\n\t\t\t// adapted from AWS implementation\n\t\t\tif record.Type != \"A\" {\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif d.isKopsManagedDNSName(record.Name) {","sourceCodeStart":1320,"sourceCodeEnd":1356,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/resources/gce/gce.go#L1320-L1356","documentation":"This error is returned by clusterDiscoveryGCE.listGCEDNSZone when the Google Cloud DNS ManagedZones().List API call fails while enumerating DNS zones during cluster resource discovery (e.g. 'kops delete cluster'). kops wraps the underlying GCP SDK error so the user knows which phase of discovery failed. It is a pass-through wrapper: the real cause (auth, quota, API outage) is in the wrapped %v error.","triggerScenarios":"The Cloud DNS managedZones.list call for the cluster's GCP project returns an error: invalid/missing credentials, disabled Cloud DNS API, project mismatch, network failure, or API quota/rate-limit rejection.","commonSituations":"Expired or missing GOOGLE_APPLICATION_CREDENTIALS / wrong service account when running kops delete cluster; Cloud DNS API not enabled in the project; typo in the GCE project or --cloud gce with insufficient IAM roles (dns.reader missing); transient Google API 500/503 or rate limits.","solutions":["Verify credentials: ensure GOOGLE_APPLICATION_CREDENTIALS points to a valid service-account JSON with Cloud DNS read permission (roles/dns.reader).","Confirm the Cloud DNS API (dns.googleapis.com) is enabled: gcloud services enable dns.googleapis.com --project <project>.","Re-run gcloud dns managed-zones list --project <project> manually to reproduce and see the raw API error.","If the cause is a transient API error (429/5xx), wait for the quota window or retry; for persistent auth errors, fix credentials and retry kops delete cluster."],"exampleFix":"// before (ambiguous project/creds)\nkops delete cluster --name mycluster.k8s.local\n// after (explicit valid creds & project)\nexport GOOGLE_APPLICATION_CREDENTIALS=/path/sa.json\ngcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS\nkops delete cluster --name mycluster.k8s.local --cloud gce","handlingStrategy":"try-catch","validationCode":"cmd := exec.Command(\"gcloud\", \"dns\", \"managed-zones\", \"list\", \"--project\", project, \"--format=json\")\nif err := cmd.Run(); err != nil {\n    return fmt.Errorf(\"precheck failed: Cloud DNS API unreachable or credentials invalid: %w\", err)\n}","typeGuard":"var apiErr *googleapi.Error\nif errors.As(err, &apiErr) && apiErr.Code == 403 {\n    // credentials/permission problem, not transient\n}","tryCatchPattern":"_, err := d.gceCloud.CloudDNS().ManagedZones().List(project)\nvar apiErr *googleapi.Error\nif errors.As(err, &apiErr) {\n    switch apiErr.Code {\n    case 403:\n        // fix IAM / credentials before retrying\n    case 429, 500, 503:\n        // back off and retry\n    }\n}","preventionTips":["Pre-flight check gcloud auth list and gcloud dns managed-zones list before running kops delete.","Grant roles/dns.reader (and dns.admin for delete flows) to the service account.","Keep GOOGLE_APPLICATION_CREDENTIALS pointing at a non-expired key.","Enable the Cloud DNS API in the target project."],"tags":["gce","dns","gcp","cloud-provider"],"backgroundTag":"gcp-api-auth-failure","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}