kubernetes/kops · error

error querying for dns support: %v

Error message

error querying for dns support: %v

What it means

VPC.Find additionally queries DescribeVpcAttribute for enableDnsSupport (and dnsHostnames) to populate the actual state, wrapping any API failure with this message. The VPC was found, but its DNS-support attribute could not be read.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/vpc.go:131

		}

		pool := aws.ToString(association.Ipv6Pool)
		if pool == "Amazon" {
			actual.AmazonIPv6 = aws.Bool(true)
			actual.IPv6CIDR = association.Ipv6CidrBlock
			e.IPv6CIDR = association.Ipv6CidrBlock
			break
		} else if actual.IPv6CIDR == nil {
			actual.IPv6CIDR = association.Ipv6CidrBlock
			e.IPv6CIDR = association.Ipv6CidrBlock
		}
	}

	if actual.ID != nil {
		request := &ec2.DescribeVpcAttributeInput{VpcId: actual.ID, Attribute: ec2types.VpcAttributeNameEnableDnsSupport}
		response, err := cloud.EC2().DescribeVpcAttribute(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error querying for dns support: %v", err)
		}
		actual.EnableDNSSupport = response.EnableDnsSupport.Value
	}

	if actual.ID != nil {
		request := &ec2.DescribeVpcAttributeInput{VpcId: actual.ID, Attribute: ec2types.VpcAttributeNameEnableDnsHostnames}
		response, err := cloud.EC2().DescribeVpcAttribute(ctx, request)
		if err != nil {
			return nil, fmt.Errorf("error querying for dns support: %v", err)
		}
		actual.EnableDNSHostnames = response.EnableDnsHostnames.Value
	}

	// Prevent spurious comparison failures
	actual.Shared = e.Shared
	if e.ID == nil {
		e.ID = actual.ID
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Add ec2:DescribeVpcAttribute to the kops IAM policy
2. Check the wrapped %v cause; re-run after transient errors
3. If the VPC was deleted concurrently, clean up cluster state (kops delete cluster) and recreate

// pre-flight permission check
// aws iam simulate-principal-policy --policy-source-arn <role> --action-names ec2:DescribeVpcAttribute

if err := kopsUpdate(); err != nil && strings.Contains(err.Error(), "error querying for dns support") {
  var ae smithy.APIError
  if errors.As(err, &ae) && ae.ErrorCode() == "ThrottlingException" {
    return retryAfter(backoff)
  }
  return fmt.Errorf("grant ec2:DescribeVpcAttribute to the kops role: %w", err)
}

When it happens

Trigger: Find on an existing VPC where DescribeVpcAttribute errors: missing ec2:DescribeVpcAttribute permission, throttling, VPC deleted concurrently between DescribeVpcs and this call, or invalid VPC ID.

Common situations: IAM policy allows DescribeVpcs but not DescribeVpcAttribute; AWS throttling during big applies; race with VPC deletion by another operator/pipeline.

Related errors

• error deleting Subnet %q: %v
• error listing subnets: %v
• error detaching InternetGateway %q: %v
• error associating VPC with hosted zone %q: %v
• VPC ID is required when EgressOnlyInternetGateway is shared

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3bead41ce79e664a. Report an issue: GitHub.