kubernetes/kops · error

error fetching DNS HostedZone by id %q: %v

Error message

error fetching DNS HostedZone by id %q: %v

What it means

After ListHostedZonesByName found exactly one matching zone by name, the follow-up Route53 GetHostedZone call for that zone's ID failed. The zone existed moments earlier in the list response, so this usually indicates a transient API failure, permission difference, or the zone being deleted concurrently.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnszone.go:158

	var zones []route53types.HostedZone
	for _, zone := range response.HostedZones {
		if aws.ToString(zone.Name) == findName && zone.Config.PrivateZone == fi.ValueOf(e.Private) {
			zones = append(zones, zone)
		}
	}

	if len(zones) == 0 {
		return nil, nil
	} else if len(zones) != 1 {
		return nil, fmt.Errorf("found multiple hosted zones matched name %q", findName)
	} else {
		request := &route53.GetHostedZoneInput{
			Id: zones[0].Id,
		}

		response, err := cloud.Route53().GetHostedZone(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error fetching DNS HostedZone by id %q: %v", *request.Id, err)
		}

		return response, nil
	}
}

func (e *DNSZone) Run(c *fi.CloudupContext) error {
	return fi.CloudupDefaultDeltaRunMethod(e, c)
}

func (s *DNSZone) CheckChanges(a, e, changes *DNSZone) error {
	if fi.ValueOf(e.Name) == "" {
		return fi.RequiredField("Name")
	}
	return nil
}

func (_ *DNSZone) RenderAWS(t *awsup.AWSAPITarget, a, e, changes *DNSZone) error {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the wrapped %v cause; fix IAM route53:GetHostedZone if AccessDenied
2. If NoSuchHostedZone, confirm the zone still exists and re-run; clear stale references if it was intentionally deleted
3. Retry on throttling with backoff
4. Re-run kops once `aws route53 get-hosted-zone --id <id>` succeeds

out, err := r53.ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(name)})
if err != nil {
    return err
}
if len(out.HostedZones) == 1 {
    if _, err := r53.GetHostedZone(ctx, &route53.GetHostedZoneInput{Id: out.HostedZones[0].Id}); err != nil {
        return fmt.Errorf("precheck get after list failed for %s: %w", aws.ToString(out.HostedZones[0].Id), err)
    }
}

func isNoSuchHostedZone(err error) bool {
    return awsup.AWSErrorCode(err) == "NoSuchHostedZone"
}

response, err := cloud.Route53().GetHostedZone(ctx, request)
if err != nil {
    if isNoSuchHostedZone(err) {
        return nil, nil // deleted concurrently; treat as absent and recreate
    }
    if isThrottling(err) {
        return retryWithBackoff(ctx, request)
    }
    return nil, fmt.Errorf("error fetching DNS HostedZone by id %q: %w", aws.ToString(request.Id), err)
}

When it happens

Trigger: GetHostedZone(zones[0].Id) errors: throttling, AccessDenied on GetHostedZone (though list succeeded), NoSuchHostedZone due to concurrent deletion, network failure between the two calls.

Common situations: IAM policy allows list but not get on some zones (resource-level conditions); zone deleted by automation between calls; transient AWS throttling during a large reconcile.

Related errors

• error fetching DNS HostedZone %q: %v
• error listing DNS HostedZones: %v
• error creating DNS HostedZone %q: %v
• error applying DNS changeset for zone %s: %v
• error listing resource record sets: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/763e5867b3b975ae. Report an issue: GitHub.