{"record":{"id":"eafab8ea944c342d","repo":"kubernetes/kops","slug":"error-querying-zones-v","errorCode":null,"errorMessage":"error querying zones: %v","messagePattern":"error querying zones: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/utils.go","lineNumber":246,"sourceCode":"\tdefault:\n\t\treturn nil, fmt.Errorf(\"unknown CloudProvider %q\", cluster.GetCloudProvider())\n\t}\n\treturn cloud, nil\n}\n\nfunc FindDNSHostedZone(dns dnsprovider.Interface, clusterDNSName string, dnsType kops.DNSType) (string, error) {\n\tklog.V(2).Infof(\"Querying for all DNS zones to find match for %q\", clusterDNSName)\n\n\tclusterDNSName = \".\" + strings.TrimSuffix(clusterDNSName, \".\")\n\n\tzonesProvider, ok := dns.Zones()\n\tif !ok {\n\t\treturn \"\", fmt.Errorf(\"dns provider %T does not support zones\", dns)\n\t}\n\n\tallZones, err := zonesProvider.List()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error querying zones: %v\", err)\n\t}\n\n\tvar zones []dnsprovider.Zone\n\tfor _, z := range allZones {\n\t\tzoneName := \".\" + strings.TrimSuffix(z.Name(), \".\")\n\n\t\tif !strings.HasSuffix(clusterDNSName, zoneName) {\n\t\t\tcontinue\n\t\t}\n\n\t\tif dnsType != \"\" {\n\t\t\tif awsZone, ok := z.(*route53.Zone); ok {\n\t\t\t\thostedZone := awsZone.Route53HostedZone()\n\t\t\t\tif hostedZone.Config != nil {\n\t\t\t\t\tzoneDNSType := kops.DNSTypePublic\n\t\t\t\t\tif hostedZone.Config.PrivateZone {\n\t\t\t\t\t\tzoneDNSType = kops.DNSTypePrivate\n\t\t\t\t\t}","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/utils.go#L228-L264","documentation":"After a zones-capable provider is found, FindDNSHostedZone calls zonesProvider.List() to enumerate all hosted zones. Any error returned by the provider's backend (auth failure, throttling, network error) is wrapped verbatim with %v into this message.","triggerScenarios":"FindDNSHostedZone during `kops create cluster`/`update cluster` when zonesProvider.List() fails: invalid Route53 credentials, expired token, AWS API throttling, network outage, or IAM policy denying route53:ListHostedZones.","commonSituations":"CI runner without AWS credentials (unset AWS_ACCESS_KEY_ID); IAM role missing Route53 read permissions; Route53 API 5xx/throttling bursts in large accounts; DNS service outage for the configured provider.","solutions":["Inspect the embedded cause (%v suffix) for the provider API error; fix credentials first (env vars / credential files / instance role).","Grant the caller IAM permission to list hosted zones (route53:ListHostedZones for AWS).","Retry after transient failures; check provider status pages and network egress to the DNS API endpoint."],"exampleFix":"// before\nexport AWS_ACCESS_KEY_ID=   # empty -> List fails\n// after\nexport AWS_ACCESS_KEY_ID=AKIA...\nexport AWS_SECRET_ACCESS_KEY=...  # then rerun kops update cluster","handlingStrategy":"try-catch","validationCode":"if _, err := zonesProvider.List(); err != nil { /* fix creds/perm before kops run */ }","typeGuard":null,"tryCatchPattern":"id, err := FindDNSHostedZone(dns, name, dnsType)\nif err != nil {\n    var retryable bool\n    // inspect wrapped cause; retry with backoff on throttle/5xx\n    klog.Errorf(\"zone listing failed: %v\", err)\n}","preventionTips":["Ensure DNS API credentials and IAM read permissions before kops runs.","Retry with exponential backoff on throttling errors.","Monitor provider status pages; fail fast with a preflight List() in scripts."],"tags":["dns","route53","api-error","hosted-zone"],"backgroundTag":"dns-zone-list-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}