kubernetes/kops · error

error querying for zones: %v

Error message

error querying for zones: %v

What it means

newDNSOp builds the per-update operation by first listing zones through the dnsCache (ListZones with a validity window). If listing zones fails — provider API error, auth failure, no zones interface — it returns 'error querying for zones: %v'. Both runOnce and RemoveRecordsImmediate depend on this, so a failure blocks all DNS updates and deletions.

Source

Thrown at dns-controller/pkg/dns/dnscontroller.go:393

		return errors[0]
	}

	return nil
}

// dnsOp manages a single dns change; we cache results and state for the duration of the operation
type dnsOp struct {
	dnsCache     *dnsCache
	zones        map[string]dnsprovider.Zone
	recordsCache map[string][]dnsprovider.ResourceRecordSet

	changesets map[string]dnsprovider.ResourceRecordChangeset
}

func newDNSOp(zoneRules *ZoneRules, dnsCache *dnsCache) (*dnsOp, error) {
	zones, err := dnsCache.ListZones(zoneListCacheValidity)
	if err != nil {
		return nil, fmt.Errorf("error querying for zones: %v", err)
	}

	// First we build up a map of all zones by name,
	// then we go through and pick the "correct" zone for each name
	allZoneMap := make(map[string][]dnsprovider.Zone)
	for _, zone := range zones {
		name := EnsureDotSuffix(zone.Name())
		allZoneMap[name] = append(allZoneMap[name], zone)
	}

	zoneMap := make(map[string]dnsprovider.Zone)
	for name, zones := range allZoneMap {
		var matches []dnsprovider.Zone
		for _, zone := range zones {
			if zoneRules.MatchesExplicitly(zone) {
				matches = append(matches, zone)
			}
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Fix the credentials used by the controller (instance profile / service account) and verify with the cloud CLI from the same environment.
2. Confirm network egress from the controller pod to the provider DNS API (no blocking NetworkPolicy/NAT misconfig).
3. Verify the --dns provider flag matches your environment and that IAM permits zone listing (route53:ListHostedZones).
4. Check the wrapped inner error for the exact provider cause; the cache will retry on the next loop tick.

Example fix

// before: controller service account with no zone-list permission
//   AccessDenied: not authorized to perform route53:ListHostedZones
// after: attach read policy to the controller role
{
  "Effect": "Allow",
  "Action": ["route53:ListHostedZones", "route53:ListHostedZonesByName", "route53:GetHostedZone"],
  "Resource": "*"
}

// pre-flight from the controller's environment
// aws route53 list-hosted-zones --max-items 1   (or provider equivalent)
// must succeed before starting the controller
zones, err := dnsCache.ListZones(zoneListCacheValidity)
if err != nil {
    klog.Fatalf("zone discovery failed at startup: %v", err)
}

op, err := newDNSOp(zoneRules, dnsCache)
if err != nil {
    // inspect wrapped cause: auth vs network vs permission
    klog.Errorf("dns op build failed: %v", err)
    return err // let the watcher retry after backoff
}

When it happens

Trigger: dnsCache.ListZones fails: underlying provider's Zones() call errors, credentials invalid, network unreachable, or the provider does not support zone enumeration.

Common situations: Expired/missing cloud credentials (AWS keys, GCP service account), VPC without internet egress to the DNS API, wrong --dns= provider flag, IAM missing route53:ListHostedZones.

Related errors

• DNS provider does not support zones
• error querying for DNS zones: %v
• error initializing DNS cache: %v
• error applying DNS changeset for zone %s: %v
• zone does not support resource records %q

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/527317f4aa9798f3. Report an issue: GitHub.