kubernetes/kops · error

error fetching DNS HostedZone %q: %v

Error message

error fetching DNS HostedZone %q: %v

What it means

Wraps any failure from the Route53 GetHostedZone call made by DNSZone.findExisting when kOps looks up an existing hosted zone by the task's ZoneID. Only the NoSuchHostedZone error is treated as 'zone absent'; every other API failure (auth, throttling, network, malformed ID) is wrapped in this message. Note findID is always empty here (a latent bug), so %q prints "".

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnszone.go:117

	// Avoid spurious changes
	actual.Lifecycle = e.Lifecycle

	return actual, nil
}

func (e *DNSZone) findExisting(ctx context.Context, cloud awsup.AWSCloud) (*route53.GetHostedZoneOutput, error) {
	findID := ""
	if e.ZoneID != nil {
		request := &route53.GetHostedZoneInput{
			Id: e.ZoneID,
		}

		response, err := cloud.Route53().GetHostedZone(ctx, request)
		if err != nil {
			if awsup.AWSErrorCode(err) == "NoSuchHostedZone" {
				return nil, nil
			} else {
				return nil, fmt.Errorf("error fetching DNS HostedZone %q: %v", findID, err)
			}
		} else {
			return response, nil
		}
	}

	findName := fi.ValueOf(e.DNSName)
	if findName == "" {
		return nil, nil
	}
	if !strings.HasSuffix(findName, ".") {
		findName += "."
	}
	request := &route53.ListHostedZonesByNameInput{
		DNSName: aws.String(findName),
	}

	response, err := cloud.Route53().ListHostedZonesByName(ctx, request)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped %v cause: fix IAM permissions (route53:GetHostedZone) or credentials if AccessDenied/ auth error
2. If throttling, retry after backoff or reduce concurrent kOps operations
3. Verify the ZoneID in the cluster spec matches an existing zone (aws route53 get-hosted-zone --id ...)
4. If the zone no longer exists intentionally, clear e.ZoneID so findExisting falls back to name-based lookup (NoSuchHostedZone is already handled as nil,nil)
5. Ensure zone ID includes the /hostedzone/ prefix as returned by the API

Example fix

// before
return nil, fmt.Errorf("error fetching DNS HostedZone %q: %v", findID, err)
// after
return nil, fmt.Errorf("error fetching DNS HostedZone by id %q: %v", aws.ToString(e.ZoneID), err)

zoneID := aws.ToString(e.ZoneID)
if zoneID != "" {
    _, err := cloud.Route53().GetHostedZone(ctx, &route53.GetHostedZoneInput{Id: aws.String(zoneID)})
    if err != nil && awsup.AWSErrorCode(err) != "NoSuchHostedZone" {
        return fmt.Errorf("precheck: cannot read hosted zone %s: %w", zoneID, err)
    }
}

func isAuthError(err error) bool {
    code := awsup.AWSErrorCode(err)
    return code == "AccessDenied" || code == "AuthFailure" || code == "UnauthorizedOperation"
}

resp, err := cloud.Route53().GetHostedZone(ctx, req)
if err != nil {
    if awsup.AWSErrorCode(err) == "NoSuchHostedZone" {
        return nil, nil // zone gone: treat as absent
    }
    if awsup.AWSErrorCode(err) == "Throttling" {
        return nil, retryAfterBackoff(ctx, req)
    }
    return nil, fmt.Errorf("error fetching DNS HostedZone by id %q: %w", aws.ToString(req.Id), err)
}

When it happens

Trigger: Route53 GetHostedZone returns an unexpected error while resolving e.ZoneID during Find or RenderTerraform: invalid/expired AWS credentials, IAM missing route53:GetHostedZone, API throttling, network failure, or a ZoneID value with invalid format (Route53 InvalidInput / InvalidDomainName).

Common situations: Cluster spec references a zone ID that was deleted in another account/region; IAM policy lacking route53:GetHostedZone; AWS API throttling during large reconcile runs; copying a zone ID without the /hostedzone/ prefix.

Related errors

• error listing DNS HostedZones: %v
• error fetching DNS HostedZone by id %q: %v
• error creating DNS HostedZone %q: %v
• error applying DNS changeset for zone %s: %v
• error listing resource record sets: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/74580e4be515fda3. Report an issue: GitHub.