kubernetes/kops · error

DNSZone not set

Error message

DNSZone not set

What it means

Run() requires spec.dnsZone to be set whenever the cluster publishes DNS records (cluster.PublishesDNSRecords()). Internal gossip clusters skip this, but any cluster relying on DNS for API/node discovery must have a dnsZone, so Run fails fast when it is empty.

Source

Thrown at upup/pkg/fi/cloudup/apply_cluster.go:312

				return nil, fmt.Errorf("kops version older than last used to update the cluster")
			}
		} else if err != os.ErrNotExist {
			return nil, fmt.Errorf("error reading last kops version used to update: %v", err)
		}
	}

	cloud := c.Cloud

	err = validation.DeepValidate(c.Cluster, c.InstanceGroups, true, c.Clientset.VFSContext(), cloud)
	if err != nil {
		return nil, err
	}

	if cluster.Spec.KubernetesVersion == "" {
		return nil, fmt.Errorf("KubernetesVersion not set")
	}
	if cluster.Spec.DNSZone == "" && cluster.PublishesDNSRecords() {
		return nil, fmt.Errorf("DNSZone not set")
	}

	l := &Loader{}
	l.Init()

	keyStore, err := c.Clientset.KeyStore(cluster)
	if err != nil {
		return nil, err
	}

	sshCredentialStore, err := c.Clientset.SSHCredentialStore(cluster)
	if err != nil {
		return nil, err
	}

	secretStore, err := c.Clientset.SecretStore(cluster)
	if err != nil {
		return nil, err

View on GitHub (pinned to 4c8573c808)

Solutions

1. Set spec.dnsZone to an existing route53/GCS/DNS zone in `kops edit cluster` (e.g. dnsZone: example.com) and rerun.
2. Create the DNS zone first if none exists (kops create cluster --dns-zone=example.com or your cloud's zone tooling).
3. If the cluster is truly meant to be gossip-only (Kubernetes internally), configure topology so the cluster uses gossip (e.g. --topology internal with gossip DNS) — otherwise DNS publishing is required.

Example fix

// before
spec:
  kubernetesVersion: 1.29.2
// after
spec:
  kubernetesVersion: 1.29.2
  dnsZone: example.com

if cluster.Spec.DNSZone == "" && cluster.PublishesDNSRecords() {
    return fmt.Errorf("spec.dnsZone is required for clusters publishing DNS records")
}

When it happens

Trigger: Running kops update cluster/apply on a public cluster where spec.dnsZone is empty and the cluster still publishes DNS records (not gossip/None topology).

Common situations: Hand-built or templated cluster spec missing spec.dnsZone; switching an existing cluster spec to a topology that requires DNS without adding the zone; users of gossip clusters who set a topology that re-enables DNS publishing.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• validation of the full cluster and instance group specs fail
• error populating configuration: %v
• configuration must include Subnets
• must configure at least one Node InstanceGroup
• building full cluster spec: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ed7e2fd0b7715f2b. Report an issue: GitHub.