kubernetes/kops · error

error getting GCE DNS zone data %v

Error message

error getting GCE DNS zone data %v

What it means

Returned by listGCEDNSZone when CloudDNS().ResourceRecordSets().List fails for a specific managed zone after zones were listed successfully. kops needs the A records to identify cluster-owned DNS entries during discovery. The wrapped error carries the true cause from the Google Cloud DNS API.

Source

Thrown at pkg/resources/gce/gce.go:1347

	}
	return false
}

func (d *clusterDiscoveryGCE) listGCEDNSZone() ([]*resources.Resource, error) {
	var resourceTrackers []*resources.Resource

	managedZones, err := d.gceCloud.CloudDNS().ManagedZones().List(d.gceCloud.Project())
	if err != nil {
		return nil, fmt.Errorf("error getting GCE DNS zones %v", err)
	}

	for _, zone := range managedZones {
		if !strings.HasSuffix(d.clusterDNSName(), zone.DnsName) {
			continue
		}
		rrsets, err := d.gceCloud.CloudDNS().ResourceRecordSets().List(d.gceCloud.Project(), zone.Name)
		if err != nil {
			return nil, fmt.Errorf("error getting GCE DNS zone data %v", err)
		}

		for _, record := range rrsets {
			// adapted from AWS implementation
			if record.Type != "A" {
				continue
			}

			if d.isKopsManagedDNSName(record.Name) {
				resource := resources.Resource{
					Name:         record.Name,
					ID:           record.Name,
					Type:         typeDNSRecord,
					GroupDeleter: deleteDNSRecords,
					GroupKey:     zone.Name,
					Obj:          record,
				}
				resourceTrackers = append(resourceTrackers, &resource)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-run kops delete cluster; if transient (429/5xx) it often succeeds on retry after a short wait.
2. Check IAM: the service account needs dns.reader (or dns.resourceRecordSets.list) on the project.
3. Run gcloud dns record-sets list --zone <zone> --project <project> to see the raw error and confirm zone accessibility.
4. If a specific zone is being deleted concurrently, wait for that operation to finish before running discovery.

zones, err := dnsService.ManagedZones.List(project).Do()
if err != nil {
    return fmt.Errorf("cannot reach Cloud DNS API: %w", err)
}
for _, z := range zones.ManagedZones {
    if _, err := dnsService.ResourceRecordSets.List(project, z.Name).Do(); err != nil {
        return fmt.Errorf("RRSet listing not permitted for zone %s: %w", z.Name, err)
    }
}

var apiErr *googleapi.Error
if errors.As(err, &apiErr) && (apiErr.Code == 429 || apiErr.Code >= 500) {
    // transient: safe to retry with backoff
}

rrsets, err := c.CloudDNS().ResourceRecordSets().List(project, zoneName)
var apiErr *googleapi.Error
if errors.As(err, &apiErr) && (apiErr.Code == 429 || apiErr.Code >= 500) {
    time.Sleep(backoff)
    rrsets, err = c.CloudDNS().ResourceRecordSets().List(project, zoneName)
}

When it happens

Trigger: resourceRecordSets.list for (project, zone.Name) fails: the zone was deleted concurrently, transient API error, rate limit (per-zone RRSet list is quota heavy), or permissions allow zones.list but not RRSet listing.

Common situations: Concurrent deletion/renaming of the DNS zone while kops is scanning; hitting Cloud DNS QPS quotas in projects with many zones; IAM policy drift after zones listed fine (unlikely but possible with cached tokens); network interruption mid-discovery.

Related errors

• error getting GCE DNS zones %v
• error deleting GCE DNS resource record set %v
• DNS not implemented on azureCloud
• error building node identifier: %w
• creating gce IPAM controller: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/7c4d8bc69d1cb12f. Report an issue: GitHub.