kubernetes/kops · error

error getting GCE DNS zones %v

Error message

error getting GCE DNS zones %v

What it means

This error is returned by clusterDiscoveryGCE.listGCEDNSZone when the Google Cloud DNS ManagedZones().List API call fails while enumerating DNS zones during cluster resource discovery (e.g. 'kops delete cluster'). kops wraps the underlying GCP SDK error so the user knows which phase of discovery failed. It is a pass-through wrapper: the real cause (auth, quota, API outage) is in the wrapped %v error.

Source

Thrown at pkg/resources/gce/gce.go:1338

	return d.clusterName + "."
}

func (d *clusterDiscoveryGCE) isKopsManagedDNSName(name string) bool {
	prefix := []string{`api`, `api.internal`, `bastion`}
	for _, p := range prefix {
		if name == p+"."+d.clusterDNSName() {
			return true
		}
	}
	return false
}

func (d *clusterDiscoveryGCE) listGCEDNSZone() ([]*resources.Resource, error) {
	var resourceTrackers []*resources.Resource

	managedZones, err := d.gceCloud.CloudDNS().ManagedZones().List(d.gceCloud.Project())
	if err != nil {
		return nil, fmt.Errorf("error getting GCE DNS zones %v", err)
	}

	for _, zone := range managedZones {
		if !strings.HasSuffix(d.clusterDNSName(), zone.DnsName) {
			continue
		}
		rrsets, err := d.gceCloud.CloudDNS().ResourceRecordSets().List(d.gceCloud.Project(), zone.Name)
		if err != nil {
			return nil, fmt.Errorf("error getting GCE DNS zone data %v", err)
		}

		for _, record := range rrsets {
			// adapted from AWS implementation
			if record.Type != "A" {
				continue
			}

			if d.isKopsManagedDNSName(record.Name) {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify credentials: ensure GOOGLE_APPLICATION_CREDENTIALS points to a valid service-account JSON with Cloud DNS read permission (roles/dns.reader).
2. Confirm the Cloud DNS API (dns.googleapis.com) is enabled: gcloud services enable dns.googleapis.com --project <project>.
3. Re-run gcloud dns managed-zones list --project <project> manually to reproduce and see the raw API error.
4. If the cause is a transient API error (429/5xx), wait for the quota window or retry; for persistent auth errors, fix credentials and retry kops delete cluster.

Example fix

// before (ambiguous project/creds)
kops delete cluster --name mycluster.k8s.local
// after (explicit valid creds & project)
export GOOGLE_APPLICATION_CREDENTIALS=/path/sa.json
gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
kops delete cluster --name mycluster.k8s.local --cloud gce

cmd := exec.Command("gcloud", "dns", "managed-zones", "list", "--project", project, "--format=json")
if err := cmd.Run(); err != nil {
    return fmt.Errorf("precheck failed: Cloud DNS API unreachable or credentials invalid: %w", err)
}

var apiErr *googleapi.Error
if errors.As(err, &apiErr) && apiErr.Code == 403 {
    // credentials/permission problem, not transient
}

_, err := d.gceCloud.CloudDNS().ManagedZones().List(project)
var apiErr *googleapi.Error
if errors.As(err, &apiErr) {
    switch apiErr.Code {
    case 403:
        // fix IAM / credentials before retrying
    case 429, 500, 503:
        // back off and retry
    }
}

When it happens

Trigger: The Cloud DNS managedZones.list call for the cluster's GCP project returns an error: invalid/missing credentials, disabled Cloud DNS API, project mismatch, network failure, or API quota/rate-limit rejection.

Common situations: Expired or missing GOOGLE_APPLICATION_CREDENTIALS / wrong service account when running kops delete cluster; Cloud DNS API not enabled in the project; typo in the GCE project or --cloud gce with insufficient IAM roles (dns.reader missing); transient Google API 500/503 or rate limits.

Related errors

• error getting GCE DNS zone data %v
• error deleting GCE DNS resource record set %v
• DNS not implemented on azureCloud
• error building node identifier: %w
• creating gce IPAM controller: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/8d89050b69130b34. Report an issue: GitHub.