{"record":{"id":"944fdb181d81b643","repo":"kubernetes/kops","slug":"dns-zoneid-not-set","errorCode":null,"errorMessage":"DNS ZoneID not set","messagePattern":"DNS ZoneID not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/model/iam/iam_builder.go","lineNumber":789,"sourceCode":"\n// Open produces the AWS IAM policy for the given role\nfunc (b *PolicyResource) Open() (io.Reader, error) {\n\t// Defensive copy before mutation\n\tpb := *b.Builder\n\n\tif b.DNSZone != nil {\n\t\thostedZoneID := fi.ValueOf(b.DNSZone.ZoneID)\n\t\tif hostedZoneID == \"\" {\n\t\t\t// ZoneID is normally populated by DNSZone.Find before this runs. In dry-run modes that\n\t\t\t// skip Find (e.g. `kops get assets`), it may still be empty; fall back to the DNS name\n\t\t\t// so the policy renders. The resulting ARN is not a valid Route53 ARN, but the policy\n\t\t\t// is not applied in that mode.\n\t\t\thostedZoneID = fi.ValueOf(b.DNSZone.DNSName)\n\t\t\tklog.V(4).Infof(\"Falling back to DNS name %q for IAM policy because ZoneID is empty\", hostedZoneID)\n\t\t}\n\t\tif hostedZoneID == \"\" {\n\t\t\t// Dependency analysis failure?\n\t\t\treturn nil, fmt.Errorf(\"DNS ZoneID not set\")\n\t\t}\n\t\tpb.HostedZoneID = hostedZoneID\n\t}\n\n\tpolicy, err := pb.BuildAWSPolicy()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building IAM policy: %v\", err)\n\t}\n\tif policy == nil {\n\t\treturn bytes.NewReader([]byte{}), nil\n\t}\n\tj, err := policy.AsJSON()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error building IAM policy: %v\", err)\n\t}\n\treturn bytes.NewReader([]byte(j)), nil\n}\n","sourceCodeStart":771,"sourceCodeEnd":807,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/model/iam/iam_builder.go#L771-L807","documentation":"PolicyResource.Open builds the Route53 IAM policy for the cluster's DNS zone. It reads the hosted zone ID from the DNSZone task; if both ZoneID and DNSName are empty it cannot construct the Route53 ARN and returns 'DNS ZoneID not set'. The source comment flags this as a dependency-analysis failure: DNSZone.Find should normally populate ZoneID before Open runs.","triggerScenarios":"`kops update cluster` (with DNS managed via Route53) where PolicyResource.Open executes before the DNSZone task has run Find, or the DNS zone record was deleted from AWS so Find returns nothing and DNSName is also unset.","commonSituations":"The Route53 hosted zone was deleted out-of-band while kOps state still references it; dry-run/CI modes that skip DNS zone lookup; task dependency graph issue after interrupted updates; kops get assets or similar flows where Find is bypassed and even DNSName is empty.","solutions":["Verify the hosted zone still exists: `aws route53 list-hosted-zones` and compare with `kops get cluster -o yaml` (spec.dnsZone / dns name).","Recreate the hosted zone or fix the DNS configuration in the cluster spec, then rerun `kops update cluster` so DNSZone.Find populates ZoneID.","If in dry-run, ensure the DNSName is set on the DNSZone task so the fallback ARN path works.","Upgrade kOps if a recent version changed DNS task dependency ordering; check release notes for PolicyResource/DNSZone fixes."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Before update, confirm the hosted zone exists and is reachable\nzones, err := route53Client.ListHostedZonesByName(&route53.ListHostedZonesByNameInput{DNSName: aws.String(dnsName)})\nif err != nil || len(zones.HostedZones) == 0 {\n    return fmt.Errorf(\"no Route53 hosted zone found for %s\", dnsName)\n}","typeGuard":null,"tryCatchPattern":"r, err := policyResource.Open()\nif err != nil {\n    if strings.Contains(err.Error(), \"DNS ZoneID not set\") {\n        // ensure DNSZone task Find() ran; check hosted zone exists in AWS\n    }\n    return err\n}","preventionTips":["Never delete the Route53 hosted zone while kOps state references it","Run `kops update cluster` in full (not modes that skip Find) so DNSZone is populated","Ensure spec.dnsZone / DNS name is set in the cluster spec"],"tags":["aws","route53","dns","kops"],"backgroundTag":"dns-zone-id-not-set","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}