kubernetes/kops · error

error querying for route53 zones: %w

Error message

error querying for route53 zones: %w

What it means

ListRoute53Records fails while paginating ListHostedZones; kOps wraps the error as 'error querying for route53 zones'. This is the discovery step that finds zones whose name is a suffix of the cluster name, before enumerating records to delete.

Source

Thrown at pkg/resources/aws/aws.go:1819

	ctx := context.TODO()
	var resourceTrackers []*resources.Resource

	c := cloud.(awsup.AWSCloud)

	// Normalize cluster name, with leading "."
	clusterName = "." + strings.TrimSuffix(clusterName, ".")

	// TODO: If we have the zone id in the cluster spec, use it!
	var zones []route53types.HostedZone
	{
		klog.V(2).Infof("Querying for all route53 zones")

		request := &route53.ListHostedZonesInput{}
		paginator := route53.NewListHostedZonesPaginator(c.Route53(), request)
		for paginator.HasMorePages() {
			page, err := paginator.NextPage(ctx)
			if err != nil {
				return nil, fmt.Errorf("error querying for route53 zones: %w", err)
			}
			for _, zone := range page.HostedZones {
				zoneName := aws.ToString(zone.Name)
				zoneName = "." + strings.TrimSuffix(zoneName, ".")

				if strings.HasSuffix(clusterName, zoneName) {
					zones = append(zones, zone)
				}
			}
		}
	}

	for i := range zones {
		// Be super careful because we close over this later (in groupDeleter)
		zone := zones[i]

		hostedZoneID := strings.TrimPrefix(aws.ToString(zone.Id), "/hostedzone/")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant route53:ListHostedZones to the credentials (account-wide permission, not per-zone).
2. Retry; throttling and transient errors usually resolve on a subsequent pass.
3. Verify the AWS region/credentials and that STS session is valid.
4. Use aws route53 list-hosted-zones CLI with the same credentials to reproduce and isolate.
5. If the account has very many zones, ensure credentials allow full listing rather than relying on partial results.

// Pre-flight: can we list zones at all?
_, err := c.Route53().ListHostedZones(ctx, &route53.ListHostedZonesInput{MaxItems: aws.Int32(1)})
if err != nil { /* credentials lack route53:ListHostedZones or API unreachable — fix before proceeding */ }

page, err := paginator.NextPage(ctx)
if err != nil {
    if awsup.AWSErrorCode(err) == "ThrottlingException" {
        time.Sleep(backoff); continue
    }
    return nil, fmt.Errorf("error querying for route53 zones: %w", err)
}

When it happens

Trigger: ListHostedZones pagination returns AccessDenied (missing route53:ListHostedZones), ThrottlingException, or a transient/network error while iterating hosted zones.

Common situations: Credentials scoped to a specific zone ARN but lacking global route53:ListHostedZones; accounts with many hosted zones hitting pagination limits; DNS API transient failures during 'kops delete cluster'.

Related errors

• error applying DNS changeset for zone %s: %v
• DNS ZoneID not set
• error deleting route53 record %q: %v
• error listing DNS ResourceRecords: %v
• error creating ResourceRecordSets: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/b0312bf1ea7f39ee. Report an issue: GitHub.