kubernetes/kops · error

Creation of Route53 hosted zones is not supported for terraf

Error message

Creation of Route53 hosted zones is not supported for terraform

What it means

kOps deliberately refuses to generate terraform that creates Route53 hosted zones. Terraform lacks a strong notion of unmanaged resources, so kOps cannot tell whether it created the zone (and should output it) or whether it already existed. Users are expected to manage the zone externally.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnszone.go:293

				klog.Infof("No association between VPC %q and zone %q; adding", vpcName, aws.ToString(z.HostedZone.Name))
				tf := &terraformRoute53ZoneAssociation{
					ZoneID: terraformWriter.LiteralFromStringValue(*e.ZoneID),
					VPCID:  e.PrivateVPC.TerraformLink(),
				}
				return t.RenderResource("aws_route53_zone_association", *e.Name, tf)
			}
		}

		return nil
	}

	// Because we expect most users to create their zones externally,
	// we now block hostedzone creation in terraform.
	// This lets us perform deeper DNS validation, but also solves the problem
	// that otherwise we don't know if TF created the hosted zone
	// (in which case we should output it) or whether it already existed (in which case we should not)
	// The root problem here is that TF doesn't have a strong notion of an unmanaged resource
	return fmt.Errorf("Creation of Route53 hosted zones is not supported for terraform")
}

func (e *DNSZone) TerraformLink() *terraformWriter.Literal {
	if e.ZoneID != nil {
		klog.V(4).Infof("reusing existing route53 zone with id %q", *e.ZoneID)
		return terraformWriter.LiteralFromStringValue(*e.ZoneID)
	}

	return terraformWriter.LiteralSelfLink("aws_route53_zone", *e.Name)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Pre-create the hosted zone outside kOps (Route53 console, CLI, or your own TF module)
2. Add the existing zone's ID to the cluster spec (spec.dns ZoneID) so kOps reuses it via TerraformLink
3. Use a non-terraform target (e.g. --target=direct) if you want kOps to create the zone

Example fix

// before (kops cluster spec, terraform target)
 dns: { type: Public }
// after
 dns: { type: Public, zone: "Z1D633PJN98FT9" }  // existing zone reused, no creation needed

// Ensure the zone exists and pass its ID before choosing --target=terraform
out, err := svc.ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(dnsName)})
if err != nil || len(out.HostedZones) == 0 {
    return fmt.Errorf("create hosted zone %s before using terraform target", dnsName)
}

When it happens

Trigger: Running kOps with --target=terraform when the cluster's DNS is a Route53 hosted zone that kOps would need to create (DNSZone task has no existing ZoneID) — RenderTerraform is invoked and immediately returns this error.

Common situations: Users switching an existing cluster from direct/cloud-target to terraform output while DNS zone is still marked to be created; new cluster specs where hosted zone ID is not supplied in the DNS config.

Related errors

• error applying DNS changeset for zone %s: %v
• DNS ZoneID not set
• error deleting route53 record %q: %v
• error querying for route53 zones: %w
• error listing DNS ResourceRecords: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/62d2bd9da19d0a38. Report an issue: GitHub.