{"record":{"id":"aa58c86fffec9825","repo":"kubernetes/kops","slug":"error-creating-dns-hostedzone-q-v","errorCode":null,"errorMessage":"error creating DNS HostedZone %q: %v","messagePattern":"error creating DNS HostedZone %q: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/dnszone.go","lineNumber":196,"sourceCode":"\tname := aws.ToString(e.DNSName)\n\tif a == nil {\n\t\trequest := &route53.CreateHostedZoneInput{}\n\t\trequest.Name = e.DNSName\n\t\tnonce := rand.Int63()\n\t\trequest.CallerReference = aws.String(strconv.FormatInt(nonce, 10))\n\n\t\tif e.PrivateVPC != nil {\n\t\t\trequest.VPC = &route53types.VPC{\n\t\t\t\tVPCId:     e.PrivateVPC.ID,\n\t\t\t\tVPCRegion: route53types.VPCRegion(t.Cloud.Region()),\n\t\t\t}\n\t\t}\n\n\t\tklog.V(2).Infof(\"Creating Route53 HostedZone with Name %q\", name)\n\n\t\tresponse, err := t.Cloud.Route53().CreateHostedZone(ctx, request)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error creating DNS HostedZone %q: %v\", name, err)\n\t\t}\n\n\t\te.ZoneID = response.HostedZone.Id\n\t} else {\n\t\tif changes.PrivateVPC != nil {\n\t\t\trequest := &route53.AssociateVPCWithHostedZoneInput{\n\t\t\t\tHostedZoneId: a.ZoneID,\n\t\t\t\tVPC: &route53types.VPC{\n\t\t\t\t\tVPCId:     e.PrivateVPC.ID,\n\t\t\t\t\tVPCRegion: route53types.VPCRegion(t.Cloud.Region()),\n\t\t\t\t},\n\t\t\t}\n\n\t\t\tchanges.PrivateVPC = nil\n\n\t\t\tklog.V(2).Infof(\"Updating DNSZone %q\", name)\n\n\t\t\t_, err := t.Cloud.Route53().AssociateVPCWithHostedZone(ctx, request)","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/dnszone.go#L178-L214","documentation":"RenderAWS failed to create the Route53 hosted zone: the CreateHostedZone API call returned an error when provisioning a new DNSZone task (no existing zone matched). All Route53 creation failures — permissions, limits, invalid names, conflicting CallerReference — surface through this wrapper.","triggerScenarios":"CreateHostedZone errors: AccessDenied (no route53:CreateHostedZone), InvalidDomainName (bad DNSName), TooManyHostedZones (account limit, historically 500 public zones), HostedZoneAlreadyExists for a re-used CallerReference, InvalidVPCAssociation inputs for private zones (bad VPC id/region).","commonSituations":"Public zone for a domain already delegated elsewhere hitting account zone limits; misconfigured cluster DNS name (typo, uppercase, trailing dot issues); IAM role too restricted; creating a private zone with a VPC ID from the wrong region; rate limiting during parallel cluster creation.","solutions":["Read the wrapped %v cause; if HostedZoneAlreadyExists, set the existing zone's ID in the spec instead of creating a new one","If AccessDenied, grant the kOps IAM role route53:CreateHostedZone (and AssociateVPCWithHostedZone for private zones)","If InvalidDomainName, correct cluster.spec.dns/name to a valid lowercase domain","If TooManyHostedZones, delete unused zones or request a limit increase","If InvalidVPCAssociation, verify the PrivateVPC ID exists in t.Cloud.Region()"],"exampleFix":"// before\nrequest.Name = e.DNSName // e.g. \"Cluster.Example.COM\" → InvalidDomainName\n// after\nrequest.Name = aws.String(strings.ToLower(strings.TrimSuffix(aws.ToString(e.DNSName), \".\")))","handlingStrategy":"try-catch","validationCode":"name := strings.ToLower(strings.TrimSuffix(aws.ToString(e.DNSName), \".\"))\nif name == \"\" || strings.ContainsAny(name, \" _\") || net.ParseIP(name) != nil {\n    return fmt.Errorf(\"invalid hosted zone name %q\", name)\n}\nif e.PrivateVPC != nil {\n    if _, err := ec2.DescribeVpcs(ctx, &ec2.DescribeVpcsInput{VpcIds: []string{aws.ToString(e.PrivateVPC.ID)}}); err != nil {\n        return fmt.Errorf(\"VPC %s not found/accessible in region: %w\", aws.ToString(e.PrivateVPC.ID), err)\n    }\n}\n// confirm no zone already exists with this name\nout, _ := r53.ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(name + \".\")})\nfor _, z := range out.HostedZones {\n    if aws.ToString(z.Name) == name+\".\" {\n        return fmt.Errorf(\"zone %s already exists (%s); reference its ID instead of creating\", name, aws.ToString(z.Id))\n    }\n}","typeGuard":"func isRetryableRoute53Error(err error) bool {\n    switch awsup.AWSErrorCode(err) {\n    case \"Throttling\", \"RequestLimitExceeded\", \"ServiceUnavailable\", \"InternalError\":\n        return true\n    }\n    return false\n}","tryCatchPattern":"response, err := t.Cloud.Route53().CreateHostedZone(ctx, request)\nif err != nil {\n    switch awsup.AWSErrorCode(err) {\n    case \"HostedZoneAlreadyExists\":\n        // adopt existing zone instead of failing\n        return adoptExistingZone(ctx, t, e, err)\n    case \"TooManyHostedZones\":\n        return fmt.Errorf(\"hosted zone limit reached for account: %w\", err)\n    case \"InvalidDomainName\":\n        return fmt.Errorf(\"invalid DNS name %q: %w\", name, err)\n    }\n    if isRetryableRoute53Error(err) {\n        return retryCreateWithBackoff(ctx, request)\n    }\n    return fmt.Errorf(\"error creating DNS HostedZone %q: %w\", name, err)\n}","preventionTips":["Grant route53:CreateHostedZone (plus route53:AssociateVPCWithHostedZone for private zones) to the kOps role","Validate cluster DNS name is a lowercase valid domain before creating the cluster","Check the account's hosted zone limit (`aws service-quotas ...`) for large multi-cluster setups","Search for an existing zone with the same name and reference its ID rather than creating a duplicate","For private zones, verify the VPC ID exists in the same region as the cluster"],"tags":["aws","route53","dns","zone-creation","api-error"],"backgroundTag":"aws-api-call-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}