kubernetes/kops · error

error querying for DNS zones: %v

Error message

error querying for DNS zones: %v

What it means

dnsCache.ListZones refreshes the zone cache by calling List() on each zones provider. If any provider's zone listing call fails (API error, auth failure, network problem), the error is wrapped with this message and returned to the caller (newDNSOp).

Source

Thrown at dns-controller/pkg/dns/dnscache.go:81

	d.mutex.Lock()
	defer d.mutex.Unlock()

	now := nanoTime()

	if d.cachedZones != nil {
		if (d.cachedZonesTimestamp + validity.Nanoseconds()) > now {
			return d.cachedZones, nil
		}
		klog.V(2).Infof("querying all DNS zones (cache expired)")
	} else {
		klog.V(2).Infof("querying all DNS zones (no cached results)")
	}

	var allZones []dnsprovider.Zone
	for _, zonesProvider := range d.zonesProviders {
		zones, err := zonesProvider.List()
		if err != nil {
			return nil, fmt.Errorf("error querying for DNS zones: %v", err)
		}

		allZones = append(allZones, zones...)
	}
	d.cachedZones = allZones
	d.cachedZonesTimestamp = now

	return allZones, nil
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Look at the wrapped %v error for the provider-specific cause (auth vs network vs throttle).
2. Verify cloud credentials (AWS credentials, GCP service account) are present and valid.
3. Check network connectivity/firewall to the DNS provider API endpoint.
4. Retry — the cache refreshes on the next operation after the transient failure clears.

Example fix

// before: no AWS creds in env
AWS_ACCESS_KEY_ID= ./dns-controller ...
// after
export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=... AWS_REGION=us-east-1
./dns-controller ...

// pre-flight: verify credentials can list zones before starting the controller
if _, err := zonesProvider.List(); err != nil {
	return fmt.Errorf("pre-flight zone list failed: %w", err)
}

zones, err := dnsCache.ListZones()
if err != nil {
	if isAuthError(err) { renewCredentials() }
	if isThrottleError(err) { backoffAndRetry(err) }
	klog.Warningf("zone listing failed, will retry: %v", err)
}

When it happens

Trigger: A new DNS operation triggers ListZones after cache expiry; the provider's List() call fails due to API credentials, network, rate limiting, or regional endpoint issues.

Common situations: Expired or missing cloud credentials (AWS/GCP); network egress blocked to the DNS API; provider API throttling; misconfigured region causing API endpoint errors.

Related errors

• DNS provider does not support zones
• error initializing DNS cache: %v
• error applying DNS changeset for zone %s: %v
• error querying for zones: %v
• zone does not support resource records %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/38f0b0ef314f7dc9. Report an issue: GitHub.