kubernetes/kops · error

error listing hosted zones: %w

Error message

error listing hosted zones: %w

What it means

Route53 Zones.List wraps a failure of the paginated ListHostedZonesPages API call. It fires when AWS rejects or errors on listing hosted zones — credentials, throttling, or connectivity — and propagates the AWS error via %w.

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/aws/route53/zones.go:45

	"k8s.io/kops/dnsprovider/pkg/dnsprovider"
)

// Compile time check for interface adherence
var _ dnsprovider.Zones = Zones{}

type Zones struct {
	interface_ *Interface
}

func (zones Zones) List() ([]dnsprovider.Zone, error) {
	var zoneList []dnsprovider.Zone

	input := &route53.ListHostedZonesInput{}
	paginator := route53.NewListHostedZonesPaginator(zones.interface_.service, input)
	for paginator.HasMorePages() {
		page, err := paginator.NextPage(context.TODO())
		if err != nil {
			return []dnsprovider.Zone{}, fmt.Errorf("error listing hosted zones: %w", err)
		}
		for _, zone := range page.HostedZones {
			zoneList = append(zoneList, &Zone{&zone, &zones})
		}
	}
	return zoneList, nil
}

func (zones Zones) Add(zone dnsprovider.Zone) (dnsprovider.Zone, error) {
	dnsName := zone.Name()
	callerReference := string(uuid.NewUUID())
	input := route53.CreateHostedZoneInput{Name: &dnsName, CallerReference: &callerReference}
	output, err := zones.interface_.service.CreateHostedZone(context.TODO(), &input)
	if err != nil {
		return nil, err
	}
	return &Zone{output.HostedZone, &zones}, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant route53:ListHostedZones to the calling identity if AccessDenied.
2. Check the wrapped error for throttling and add backoff/retry.
3. Verify credentials resolve to the intended AWS account (`aws sts get-caller-identity`).
4. Fix any network/proxy issues blocking route53.amazonaws.com.

// verify credentials + basic route53 access first
out, err := exec.Command("aws", "sts", "get-caller-identity").Output()
if err != nil {
    return fmt.Errorf("AWS credentials invalid: %w", err)
}
_ = out

zones, err := provider.Zones().List()
if err != nil {
    if strings.Contains(err.Error(), "AccessDenied") {
        return fmt.Errorf("IAM needs route53:ListHostedZones: %w", err)
    }
    if strings.Contains(err.Error(), "Throttling") {
        time.Sleep(backoff) // then retry once
    }
    return err
}

When it happens

Trigger: Calling List() on the Route53 zones interface when ListHostedZones fails: AccessDenied on route53:ListHostedZones, throttling, invalid credentials, network error.

Common situations: IAM user/role without route53:ListHostedZones; credentials valid but scoped to another account with no zones access; SDK throttling on bursty callers.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error applying DNS changeset for zone %s: %v
• failed to load default aws config for IMDS client: %w

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d8d19696e75da413. Report an issue: GitHub.