kubernetes/kops · error

error listing DNS resource records for %q: %v

Error message

error listing DNS resource records for %q: %v

What it means

precreateDNS calls rrs.List() to fetch all resource record sets in the zone so it can detect which kOps records already exist. If the provider API call fails, the error is wrapped as 'error listing DNS resource records'. Cluster creation aborts because existing records cannot be safely compared/merged.

Source

Thrown at upup/pkg/fi/cloudup/dns.go:165

	zone, err := findZone(cluster, cloud)
	if err != nil {
		return err
	}
	if zone == nil {
		return nil
	}

	rrs, ok := zone.ResourceRecordSets()
	if !ok {
		return fmt.Errorf("error getting DNS resource records for %q", zone.Name())
	}

	recordsMap := make(map[string]dnsprovider.ResourceRecordSet)
	// TODO: We should change the filter to be a suffix match instead
	// records, err := rrs.List("", "")
	records, err := rrs.List()
	if err != nil {
		return fmt.Errorf("error listing DNS resource records for %q: %v", zone.Name(), err)
	}

	for _, record := range records {
		name := dns.EnsureDotSuffix(record.Name())
		key := string(record.Type()) + "::" + name
		recordsMap[key] = record
	}

	changeset := rrs.StartChangeset()
	// TODO: Add ChangeSet.IsEmpty() method
	var created []recordKey

	for _, recordKey := range recordKeys {
		recordKey.hostname = dns.EnsureDotSuffix(recordKey.hostname)
		foundAddress := false
		{
			dnsRecord := recordsMap[string(recordKey.rrsType)+"::"+recordKey.hostname]
			if dnsRecord != nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Retry the kops command — many failures are transient API/network errors
2. Verify IAM/API permissions: route53:ListResourceRecordSets (AWS) or DNS read scope (GCP)
3. Check DNS provider service health and rate limits; reduce concurrent runs against the same zone
4. Confirm API enabled for the project/subscription (e.g. dns.googleapis.com)

Example fix

// before
# IAM policy missing route53 read permissions -> List() fails
// after
# attach required policy
{
  "Effect": "Allow",
  "Action": ["route53:ListResourceRecordSets", "route53:ChangeResourceRecordSets", "route53:GetChange"],
  "Resource": "*"
}

// verify credentials/API access beforehand
aws route53 test-credentials: `aws route53 list-hosted-zones` must succeed with the same env/credentials kOps uses

records, err := rrs.List()
if err != nil {
    return retry.Do(3, 5*time.Second, func() error {
        _, err = rrs.List()
        return err
    })
}

When it happens

Trigger: rrs.List() returns an error while running create/update cluster: DNS provider API outage, expired/invalid credentials, throttling, or a provider SDK failure during DNS pre-creation of internal names like api.<cluster> and nodes.<cluster>.

Common situations: AWS credentials lacking route53:ListResourceRecordSets permission; Route53 API throttling (rate limiting) on large zones; transient network failure to the DNS provider API; Cloud DNS API not enabled on the GCP project.

Related errors

• error listing DNS zones: %v
• failed to apply resource record set: %s, err: %s
• failed to delete record for domain %s: %d
• failed to list dns zones: %s
• failed to extract recordsets pages for zone %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/722869b91b8a542c. Report an issue: GitHub.