kubernetes/kops · error

error listing DNS HostedZones: %v

Error message

error listing DNS HostedZones: %v

What it means

Wraps any failure from Route53 ListHostedZonesByName during name-based lookup of an existing DNSZone in findExisting (used when the task has no ZoneID). The zone-matching logic never runs, so kOps may fall through to creating a duplicate zone once the API recovers.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnszone.go:137

		} else {
			return response, nil
		}
	}

	findName := fi.ValueOf(e.DNSName)
	if findName == "" {
		return nil, nil
	}
	if !strings.HasSuffix(findName, ".") {
		findName += "."
	}
	request := &route53.ListHostedZonesByNameInput{
		DNSName: aws.String(findName),
	}

	response, err := cloud.Route53().ListHostedZonesByName(ctx, request)
	if err != nil {
		return nil, fmt.Errorf("error listing DNS HostedZones: %v", err)
	}

	var zones []route53types.HostedZone
	for _, zone := range response.HostedZones {
		if aws.ToString(zone.Name) == findName && zone.Config.PrivateZone == fi.ValueOf(e.Private) {
			zones = append(zones, zone)
		}
	}

	if len(zones) == 0 {
		return nil, nil
	} else if len(zones) != 1 {
		return nil, fmt.Errorf("found multiple hosted zones matched name %q", findName)
	} else {
		request := &route53.GetHostedZoneInput{
			Id: zones[0].Id,
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped %v cause; if AccessDenied add route53:ListHostedZonesByName to the IAM policy
2. If Throttling, retry with exponential backoff / reduce concurrency
3. Validate e.DNSName is a well-formed DNS name before running
4. Retry the kops command after confirming `aws route53 list-hosted-zones-by-name --dns-name <name>` succeeds

findName := strings.TrimSuffix(fi.ValueOf(e.DNSName), ".") + "."
if net.ParseIP(findName) != nil || !strings.Contains(strings.TrimSuffix(findName, "."), ".") {
    return fmt.Errorf("invalid DNSName %q for hosted zone lookup", findName)
}
if _, err := cloud.Route53().ListHostedZonesByName(ctx, &route53.ListHostedZonesByNameInput{DNSName: aws.String(findName)}); err != nil {
    return fmt.Errorf("precheck listing hosted zones failed: %w", err)
}

response, err := cloud.Route53().ListHostedZonesByName(ctx, request)
if err != nil {
    if awsup.AWSErrorCode(err) == "Throttling" {
        return nil, retryWithBackoff(ctx, request)
    }
    return nil, fmt.Errorf("error listing DNS HostedZones: %w", err)
}

When it happens

Trigger: cloud.Route53().ListHostedZonesByName returns an error: AccessDenied (IAM lacks route53:ListHostedZonesByName), throttling (Throttling/RequestLimitExceeded), invalid DNSName filter format, network/connectivity failure.

Common situations: Read-only IAM role missing ListHostedZonesByName; rate limiting when reconciling many clusters; DNSName misconfigured (e.g. containing invalid characters); transient AWS outage.

Related errors

• error fetching DNS HostedZone %q: %v
• error fetching DNS HostedZone by id %q: %v
• error creating DNS HostedZone %q: %v
• error applying DNS changeset for zone %s: %v
• error listing resource record sets: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/783d7738642c45b6. Report an issue: GitHub.