kubernetes/kops · error

error building dns scope: %v

Error message

error building dns scope: %v

What it means

NewServiceController returns "error building dns scope: %v" when dns.CreateScope("service") fails while constructing the ServiceController. The scope is the provider-backed record namespace for service DNS records; without it the controller cannot be instantiated. The underlying provider error (auth, zone lookup, provider API failure) is wrapped in the message.

Source

Thrown at dns-controller/pkg/watchers/service.go:47

	"k8s.io/klog/v2"
	"k8s.io/kops/dns-controller/pkg/dns"
	"k8s.io/kops/dns-controller/pkg/util"
	"k8s.io/kops/upup/pkg/fi/utils"
)

// ServiceController watches for services with dns annotations
type ServiceController struct {
	util.Stoppable
	client    kubernetes.Interface
	namespace string
	scope     dns.Scope
}

// NewServiceController creates a ServiceController
func NewServiceController(client kubernetes.Interface, dns dns.Context, namespace string) (*ServiceController, error) {
	scope, err := dns.CreateScope("service")
	if err != nil {
		return nil, fmt.Errorf("error building dns scope: %v", err)
	}
	c := &ServiceController{
		client:    client,
		namespace: namespace,
		scope:     scope,
	}

	return c, nil
}

// Run starts the ServiceController.
func (c *ServiceController) Run() {
	klog.Infof("starting service controller")

	stopCh := c.StopChannel()
	go c.runWatcher(stopCh)

	<-stopCh

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped '%v' error for the provider-level cause.
2. Validate the DNS provider name and zone configuration flags passed to dns-controller.
3. Verify cloud DNS API credentials and permissions for the controller identity.
4. Recreate the hosted zone if it was removed, then restart dns-controller.

Example fix

// before: wrong provider name
--dns=route53aaa
// after
--dns=aws-route53

// Go: ensure the dns context and provider are functional before NewServiceController
if dnsContext == nil {
    return nil, errors.New("dns context must be initialized before NewServiceController")
}
if _, err := dnsContext.CreateScope("service"); err != nil {
    return fmt.Errorf("provider scope preflight failed: %w", err)
}

sc, err := NewServiceController(client, dnsContext, namespace)
if err != nil {
    if strings.Contains(err.Error(), "error building dns scope") {
        klog.Errorf("DNS provider/zone misconfigured: %v", err)
        return err
    }
    return err
}

When it happens

Trigger: Calling NewServiceController(client, dnsContext, namespace) where dns.Context.CreateScope("service") returns an error from the dnsprovider implementation - commonly invalid provider configuration, unavailable hosted zone, or cloud API auth failure during zone initialization.

Common situations: Incorrect --dns provider flag; Route53/AzureDNS/GoogleDNS credentials missing or insufficient; hosted zone deleted or not yet created in a new cluster; dns context built from a failed provider init.

Related errors

• error building dns scope: %v
• DNS provider does not support zones
• no suitable zone found for %q
• couldn't open DNS provider configuration %s: %#v
• could not init DNS provider %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/063bf4ae15d43204. Report an issue: GitHub.