kubernetes/kops · error

error building dns client: %w

Error message

error building dns client: %w

What it means

This error wraps a failure from gophercloud's openstack.NewDNSV2 when kOps tries to build a Designate DNS v2 service client during OpenstackCloud construction. It occurs only when the cluster spec enables DNS (hasDNS) but the Designate endpoint cannot be resolved or the client cannot be authenticated/created for the given region.

Source

Thrown at upup/pkg/fi/cloudup/openstack/cloud.go:422

	// 2.47 is the minimum version where the compute API /server/details returns flavor names
	novaClient.Microversion = "2.47"

	glanceClient, err := openstack.NewImageV2(provider, gophercloud.EndpointOpts{
		Type:   "image",
		Region: region,
	})
	if err != nil {
		return nil, fmt.Errorf("error building glance client: %w", err)
	}

	var dnsClient *gophercloud.ServiceClient
	if hasDNS {
		dnsClient, err = openstack.NewDNSV2(provider, gophercloud.EndpointOpts{
			Type:   "dns",
			Region: region,
		})
		if err != nil {
			return nil, fmt.Errorf("error building dns client: %w", err)
		}
	}

	c := &openstackCloud{
		cinderClient:  cinderClient,
		neutronClient: neutronClient,
		novaClient:    novaClient,
		dnsClient:     dnsClient,
		glanceClient:  glanceClient,
		tags:          tags,
		region:        region,
		useOctavia:    false,
	}

	setFloatingIPSupport(c, spec)
	err = buildLoadBalancerClient(c, spec, provider, region)
	if err != nil {
		return nil, fmt.Errorf("failed to build load balancer client: %w", err)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify Designate (DNS service) is deployed and registered in the Keystone catalog for the target region (openstack service list | grep dns)
2. Check the region name in the cluster spec / OS_REGION_NAME matches an endpoint for the dns service
3. Re-run openstack auth (source rc file / fix OS_USERNAME, OS_PASSWORD, OS_PROJECT_NAME, OS_AUTH_URL) and confirm 'openstack zone list' works
4. If Designate is not used, disable the DNS requirement in the cluster spec so hasDNS is false

Example fix

// before: cluster spec pointing at wrong region
region: "RegionTwo" // no dns endpoint exists here
// after
region: "RegionOne" // region hosting the Designate endpoint

// before building the cloud, verify the dns (designate) endpoint exists
out, err := exec.Command("openstack", "endpoint", "list", "--service", "dns", "--region", region).Output()
if err != nil || len(out) == 0 { return fmt.Errorf("no designate endpoint in region %s", region) }

// go: inspect wrapped error
dnsClient, err := NewOpenstackCloud(...)
if err != nil && strings.Contains(err.Error(), "error building dns client") {
    // fail fast with guidance about Designate availability
}

When it happens

Trigger: openstack.NewDNSV2(provider, EndpointOpts{Type:"dns", Region:region}) returns an error: no 'dns' service endpoint (Designate) in the catalog for the region, endpoint discovery failure, or auth/token issues against the identity service.

Common situations: OpenStack cloud without Designate installed; wrong region name in the kops cluster spec; OS_* environment variables pointing to a project lacking access to the dns service; Keystone catalog missing the 'dns' service type.

Related errors

• failed to list dns zones: %s
• failed to find cluster dns zone
• failed to extract recordsets pages for zone %s: %v
• error building (Designate) DNS provider: %v
• failed to list dns zones: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/f98f7b9fb9ff55d5. Report an issue: GitHub.