kubernetes/kops · error

error listing DNS zones: %v

Error message

error listing DNS zones: %v

What it means

findZone enumerates DNS zones via zonesProvider.List(). Any failure listing zones (auth errors, throttling, network problems, API errors) is wrapped as 'error listing DNS zones: %v'. This prevents resolving the cluster's DNSZone to a concrete provider zone.

Source

Thrown at upup/pkg/fi/cloudup/dns.go:62

}

func findZone(cluster *kops.Cluster, cloud fi.Cloud) (dnsprovider.Zone, error) {
	dns, err := cloud.DNS()
	if err != nil {
		return nil, fmt.Errorf("error building DNS provider: %v", err)
	}
	if dns == nil {
		return nil, nil
	}

	zonesProvider, ok := dns.Zones()
	if !ok {
		return nil, fmt.Errorf("error getting DNS zones provider")
	}

	zones, err := zonesProvider.List()
	if err != nil {
		return nil, fmt.Errorf("error listing DNS zones: %v", err)
	}

	var matches []dnsprovider.Zone
	findName := strings.TrimSuffix(cluster.Spec.DNSZone, ".")
	for _, zone := range zones {
		id := zone.ID()
		name := strings.TrimSuffix(zone.Name(), ".")
		if id == cluster.Spec.DNSZone || name == findName {
			matches = append(matches, zone)
		}
	}
	if len(matches) == 0 {
		return nil, fmt.Errorf("cannot find DNS Zone %q.  Please pre-create the zone and set up NS records so that it resolves", cluster.Spec.DNSZone)
	}

	if len(matches) > 1 {
		klog.Infof("Found multiple DNS Zones matching %q, please set the cluster's spec.dnsZone to the desired Zone ID:", cluster.Spec.DNSZone)
		for _, zone := range zones {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped cause and fix the underlying API/auth/network issue (e.g. add route53:ListHostedZones IAM permission)
2. Retry the command if the failure was transient (throttling/network)
3. Verify credentials for the DNS provider account (AWS_PROFILE, AZURE creds, GCP application-default)

Example fix

// before: IAM missing list permission
{"Effect": "Deny", "Action": "route53:ListHostedZones"}
// after: allow read on route53 zones
{"Effect": "Allow", "Action": ["route53:ListHostedZones", "route53:GetHostedZone"], "Resource": "*"}

// Pre-flight: attempt a lightweight zone list with same credentials
zones, err := zonesProvider.List()
if err != nil { return fmt.Errorf("preflight DNS list failed: %w", err) }

zones, err := zonesProvider.List()
if err != nil {
    if isTransient(err) {
        time.Sleep(backoff)
        zones, err = zonesProvider.List()
    }
    if err != nil { return err }
}

When it happens

Trigger: validateDNS/precreateDNS → findZone when the provider's List() call errors: expired/insufficient credentials, rate limiting, network outage, or DNS API returning an error for the account.

Common situations: AWS credentials without route53:ListHostedZones permission; Azure/GCP DNS API quota or auth failures; transient network failures during `kops create cluster` or `kops validate cluster`.

Related errors

• error listing DNS resource records for %q: %v
• failed to apply resource record set: %s, err: %s
• failed to delete record for domain %s: %d
• failed to list dns zones: %s
• failed to find cluster dns zone

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/399f958acc1109dd. Report an issue: GitHub.