kubernetes/kops · error

error listing DNS ResourceRecords: %v

Error message

error listing DNS ResourceRecords: %v

What it means

During DNSName.Find, kops paginates Route53 ListResourceRecordSets to locate the record matching the task's ResourceName/ResourceType (dnsname.go:85). If any NextPage call fails, the error is wrapped as 'error listing DNS ResourceRecords'. The Route53 SDK error (AuthFailure, NoSuchHostedZone, Throttling, network) is embedded after the %v.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/dnsname.go:85

	findName = strings.TrimSuffix(findName, ".")

	findType := fi.ValueOf(e.ResourceType)
	if findType == "" {
		return nil, nil
	}

	request := &route53.ListResourceRecordSetsInput{
		HostedZoneId: e.Zone.ZoneID,
		// TODO: Start at correct name?
	}

	var found *route53types.ResourceRecordSet

	paginator := route53.NewListResourceRecordSetsPaginator(cloud.Route53(), request)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(ctx)
		if err != nil {
			return nil, fmt.Errorf("error listing DNS ResourceRecords: %v", err)
		}
		for _, rr := range page.ResourceRecordSets {
			resourceType := rr.Type
			name := aws.ToString(rr.Name)

			klog.V(4).Infof("Found DNS resource %q %q", resourceType, name)

			if findType != string(resourceType) {
				continue
			}

			name = strings.TrimSuffix(name, ".")

			if name == findName {
				found = &rr
				break
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Check the wrapped AWS error text for the specific cause
2. If NoSuchHostedZone: verify the hosted zone ID in the cluster spec still exists (aws route53 list-hosted-zones) and update it
3. If AccessDenied: add route53:ListResourceRecordSets to the credentials' IAM policy
4. If throttling/network: retry kops update; the failure is usually transient
5. Verify AWS_REGION / shared config points at the account where the zone lives

Example fix

// before: stale zone id in cluster spec
spec.dnsZone: ZXXXXXXXXOLD
// after
aws route53 list-hosted-zones --query 'HostedZones[?Name==`cluster.example.com.`]'
# update the kops cluster spec with the current zone ID

// Verify the zone exists and is listable before the apply
import (
	"context"
	"fmt"
	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/service/route53"
)

func zoneReadable(ctx context.Context, c *route53.Client, zoneID *string) error {
	if aws.ToString(zoneID) == "" {
		return fmt.Errorf("hosted zone ID missing")
	}
	if _, err := c.GetHostedZone(ctx, &route53.GetHostedZoneInput{Id: zoneID}); err != nil {
		return fmt.Errorf("hosted zone %s not accessible: %w", aws.ToString(zoneID), err)
	}
	return nil
}

found, err := dnsName.Find(ctx, target)
if err != nil {
	if strings.Contains(err.Error(), "NoSuchHostedZone") {
		// hosted zone deleted out-of-band: recreate zone or fix spec
	}
	return fmt.Errorf("route53 listing failed: %w", err)
}

When it happens

Trigger: ListResourceRecordSets paginator NextPage returns an error: the hosted zone ID in e.Zone.ZoneID no longer exists (zone deleted/recreated), credentials lack route53:ListResourceRecordSets, network failure, or Route53 throttling.

Common situations: kops update after the hosted zone was deleted out-of-band; assumed-role credentials without Route53 read permissions; DNS zone migrated to another AWS account so the zone ID is stale; transient network drops during long pagination.

Related errors

• DNS ZoneID not set
• error creating ResourceRecordSets: %v
• error applying DNS changeset for zone %s: %v
• error deleting route53 record %q: %v
• error querying for route53 zones: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/5ba5742944ab25bd. Report an issue: GitHub.