kubernetes/kops · error

error querying zones: %v

Error message

error querying zones: %v

What it means

After a zones-capable provider is found, FindDNSHostedZone calls zonesProvider.List() to enumerate all hosted zones. Any error returned by the provider's backend (auth failure, throttling, network error) is wrapped verbatim with %v into this message.

Source

Thrown at upup/pkg/fi/cloudup/utils.go:246

	default:
		return nil, fmt.Errorf("unknown CloudProvider %q", cluster.GetCloudProvider())
	}
	return cloud, nil
}

func FindDNSHostedZone(dns dnsprovider.Interface, clusterDNSName string, dnsType kops.DNSType) (string, error) {
	klog.V(2).Infof("Querying for all DNS zones to find match for %q", clusterDNSName)

	clusterDNSName = "." + strings.TrimSuffix(clusterDNSName, ".")

	zonesProvider, ok := dns.Zones()
	if !ok {
		return "", fmt.Errorf("dns provider %T does not support zones", dns)
	}

	allZones, err := zonesProvider.List()
	if err != nil {
		return "", fmt.Errorf("error querying zones: %v", err)
	}

	var zones []dnsprovider.Zone
	for _, z := range allZones {
		zoneName := "." + strings.TrimSuffix(z.Name(), ".")

		if !strings.HasSuffix(clusterDNSName, zoneName) {
			continue
		}

		if dnsType != "" {
			if awsZone, ok := z.(*route53.Zone); ok {
				hostedZone := awsZone.Route53HostedZone()
				if hostedZone.Config != nil {
					zoneDNSType := kops.DNSTypePublic
					if hostedZone.Config.PrivateZone {
						zoneDNSType = kops.DNSTypePrivate
					}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Inspect the embedded cause (%v suffix) for the provider API error; fix credentials first (env vars / credential files / instance role).
2. Grant the caller IAM permission to list hosted zones (route53:ListHostedZones for AWS).
3. Retry after transient failures; check provider status pages and network egress to the DNS API endpoint.

Example fix

// before
export AWS_ACCESS_KEY_ID=   # empty -> List fails
// after
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...  # then rerun kops update cluster

if _, err := zonesProvider.List(); err != nil { /* fix creds/perm before kops run */ }

id, err := FindDNSHostedZone(dns, name, dnsType)
if err != nil {
    var retryable bool
    // inspect wrapped cause; retry with backoff on throttle/5xx
    klog.Errorf("zone listing failed: %v", err)
}

When it happens

Trigger: FindDNSHostedZone during `kops create cluster`/`update cluster` when zonesProvider.List() fails: invalid Route53 credentials, expired token, AWS API throttling, network outage, or IAM policy denying route53:ListHostedZones.

Common situations: CI runner without AWS credentials (unset AWS_ACCESS_KEY_ID); IAM role missing Route53 read permissions; Route53 API 5xx/throttling bursts in large accounts; DNS service outage for the configured provider.

Related errors

• error fetching DNS HostedZone %q: %v
• error listing DNS HostedZones: %v
• error fetching DNS HostedZone by id %q: %v
• error creating DNS HostedZone %q: %v
• No matching hosted zones found for %q; please create one (e.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/eafab8ea944c342d. Report an issue: GitHub.