kubernetes/kops · error

error building dns scope: %v

Error message

error building dns scope: %v

What it means

NewPodController returns "error building dns scope: %v" when dns.CreateScope("pod") fails while constructing the PodController. The DNS scope is the per-resource namespace in the backing DNS provider context used to track pod alias records; if the provider cannot create it, the controller cannot be built at all. The wrapped error comes from the dnsprovider implementation (e.g. route53/weave provider) when initializing its zone/scope state.

Source

Thrown at dns-controller/pkg/watchers/pod.go:47

	"k8s.io/klog/v2"
	"k8s.io/kops/dns-controller/pkg/dns"
	"k8s.io/kops/dns-controller/pkg/util"
	"k8s.io/kops/upup/pkg/fi/utils"
)

// PodController watches for Pods with dns annotations
type PodController struct {
	util.Stoppable
	client    kubernetes.Interface
	namespace string
	scope     dns.Scope
}

// NewPodController creates a podController
func NewPodController(client kubernetes.Interface, dns dns.Context, namespace string) (*PodController, error) {
	scope, err := dns.CreateScope("pod")
	if err != nil {
		return nil, fmt.Errorf("error building dns scope: %v", err)
	}
	c := &PodController{
		client:    client,
		scope:     scope,
		namespace: namespace,
	}

	return c, nil
}

// Run starts the PodController.
func (c *PodController) Run() {
	klog.Infof("starting pod controller")

	stopCh := c.StopChannel()
	go c.runWatcher(stopCh)

	<-stopCh

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped error after '%v' to identify the provider-level failure (auth, zone not found, etc.).
2. Verify --dns and --dns-gossip/zone configuration flags match a valid, existing hosted zone.
3. Check cloud DNS credentials (e.g. AWS Route53 permissions) available to the controller.
4. Ensure dnsproviders are initialized (InitDnsProvider succeeded) before watchers are created in initializeWatchers.

Example fix

// before: starting controller with uninitialized dns context
podController, err := NewPodController(client, nil, ns)
// after: init provider first
dnsProvider, err := dnsprovider.InitDnsProvider(providerName, configPath)
dnsContext, err := dns.NewContext(dnsProvider)
podController, err := NewPodController(client, dnsContext, ns)

// Go: validate the dns context before constructing the controller
if dnsContext == nil {
    return nil, errors.New("dns context must be initialized (InitDnsProvider + dns.NewContext) before NewPodController")
}

pc, err := NewPodController(client, dnsContext, namespace)
if err != nil {
    if strings.Contains(err.Error(), "error building dns scope") {
        klog.Errorf("DNS provider unavailable or misconfigured: %v", err)
        // fix provider config, then retry construction
    }
    return err
}

When it happens

Trigger: Calling NewPodController(client, dnsContext, namespace) where dns.Context.CreateScope("pod") returns an error - typically because the DNS provider was not initialized correctly, the hosted zone/record set cannot be listed, or the provider returns an error from its CreateScope implementation.

Common situations: dns-controller started before the DNS provider is ready; AWS credentials missing/insufficient for Route53; the --dns flag points to a provider whose configuration is invalid; zone not yet provisioned in a freshly created cluster.

Related errors

• error building dns scope: %v
• DNS provider does not support zones
• no suitable zone found for %q
• couldn't open DNS provider configuration %s: %#v
• could not init DNS provider %q: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/4855ec586b9adcdd. Report an issue: GitHub.