What causes "error determining default DNS zone: %v" in kubernetes/kops?

Create a hosted zone matching the cluster name's parent domain in the same cloud account, then retry.

error determining default DNS zone: %v

Error message

error determining default DNS zone: %v

What it means

When spec.dnsZone is empty and the cluster publishes DNS records, kops asks the cloud's DNS service to find a hosted zone matching the cluster name. Failure of FindDNSHostedZone is wrapped in this error — usually no matching zone exists or the DNS API call failed.

Source

Thrown at upup/pkg/fi/cloudup/populate_cluster_spec.go:274

	if cluster.Spec.API.LoadBalancer != nil && cluster.Spec.API.LoadBalancer.Class == "" && cluster.Spec.CloudProvider.AWS != nil {
		cluster.Spec.API.LoadBalancer.Class = kopsapi.LoadBalancerClassClassic
	}

	if cluster.Spec.DNSZone == "" && cluster.PublishesDNSRecords() {
		dns, err := cloud.DNS()
		if err != nil {
			return err
		}
		if dns != nil {
			dnsType := kopsapi.DNSTypePublic
			if cluster.Spec.Networking.Topology != nil && cluster.Spec.Networking.Topology.DNS != "" {
				dnsType = cluster.Spec.Networking.Topology.DNS
			}

			dnsZone, err := FindDNSHostedZone(dns, cluster.ObjectMeta.Name, dnsType)
			if err != nil {
				return fmt.Errorf("error determining default DNS zone: %v", err)
			}

			klog.V(2).Infof("Defaulting DNS zone to: %s", dnsZone)
			cluster.Spec.DNSZone = dnsZone
		}
	}

	if !cluster.UsesNoneDNS() {
		if cluster.Spec.DNSZone != "" && cluster.Spec.API.PublicName == "" {
			cluster.Spec.API.PublicName = "api." + cluster.Name
		}
		if cluster.Spec.ExternalDNS == nil {
			cluster.Spec.ExternalDNS = &kopsapi.ExternalDNSConfig{}
		}
		if cluster.Spec.ExternalDNS.Provider == "" {
			cluster.Spec.ExternalDNS.Provider = kopsapi.ExternalDNSProviderDNSController
		}
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Create a hosted zone matching the cluster name's parent domain in the same cloud account, then retry.
Explicitly set spec.dnsZone (or --dns-zone) to the existing zone name so kops skips discovery.
Verify cloud credentials/IAM include DNS read permissions (e.g. route53:ListHostedZones) and inspect the wrapped %v error for the root cause.

Example fix

# before
kops create cluster --name cluster.example.com  # no example.com zone in account
# after
kops create cluster --name cluster.example.com --dns-zone example.com

Defensive patterns

Strategy: try-catch

Validate before calling

if cluster.Spec.DNSZone == "" {
	// Ensure a hosted zone exists for the cluster name's parent domain before creating
	// e.g. aws route53 list-hosted-zones-by-name --dns-name example.com
}

Try / catch

dnsZone, err := FindDNSHostedZone(dns, cluster.ObjectMeta.Name, dnsType)
if err != nil {
	return fmt.Errorf("no hosted zone found for %q; create one or pass --dns-zone: %w", cluster.ObjectMeta.Name, err)
}

Prevention

Create the parent domain hosted zone before `kops create cluster`
Always pass --dns-zone when multiple zones or accounts could match
Grant cloud credentials DNS list permissions (route53:ListHostedZones)

When it happens

Trigger: PopulateClusterSpec with an empty spec.dnsZone on a cloud with DNS (e.g. AWS Route53) where the cluster name (e.g. cluster.example.com) has no hosted zone, credentials lack route53:ListHostedZones, or the API call errors (throttling, region issues).

Common situations: Cluster name whose parent domain has no hosted zone in the account; IAM policy missing Route53 permissions; multi-account setups where the zone lives in a different AWS account; private DNS topology mismatch (private zone requested but only a public zone exists).

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/af572bc4a6e35762. Report an issue: GitHub.