What causes "failed to delete record: %v" in kubernetes/kops?

Check the wrapped error; treat 404 as record-already-deleted and make deletion idempotent in the caller or retry the Apply.

kubernetes/kops · error

failed to delete record: %v

Error message

failed to delete record: %v

What it means

In Apply()'s removals phase, each planned removal is matched against the fetched zone records by name and deleted via deleteRecord. If the DO DELETE call fails, this error wraps the cause. Note the loop continues matching other records even after a failure returns immediately — the first deletion error aborts Apply.

Source

Thrown at dnsprovider/pkg/dnsprovider/providers/do/dns.go:365

				return fmt.Errorf("failed to apply resource record set: %s, err: %s", rrset.Name(), err)
			}
		}

		klog.V(2).Info("record change set upserts complete")
	}

	if len(r.removals) > 0 {
		records, err := getRecords(r.client, r.zone.Name())
		if err != nil {
			return err
		}

		for _, record := range r.removals {
			for _, domainRecord := range records {
				if domainRecord.Name == record.Name() {
					err := deleteRecord(r.client, r.zone.Name(), domainRecord.ID)
					if err != nil {
						return fmt.Errorf("failed to delete record: %v", err)
					}
				}
			}
		}

		klog.V(2).Info("record change set removals complete")
	}

	klog.V(2).Info("record change sets successfully applied")
	return nil
}

// IsEmpty returns true if a changeset is empty, false otherwise
func (r *resourceRecordChangeset) IsEmpty() bool {
	if len(r.additions) == 0 && len(r.removals) == 0 && len(r.upserts) == 0 {
		return true
	}

View on GitHub (pinned to 4c8573c808)

Solutions

Check the wrapped error; treat 404 as record-already-deleted and make deletion idempotent in the caller or retry the Apply.
Confirm the domain still exists in DO (`doctl compute domain list`).
Use a token with write scope for the domain.
Back off and retry on 429 rate-limit responses.

Defensive patterns

Strategy: try-catch

Validate before calling

// confirm zone still exists before planning removals
_, resp, err := doClient.Domains.Get(ctx, strings.TrimSuffix(zone, "."))
if err != nil || resp.StatusCode == 404 {
    return errors.New("DO domain no longer exists; skip removals")
}

Try / catch

err := recordSet.Apply()
if err != nil && strings.Contains(err.Error(), "failed to delete record") {
    if strings.Contains(err.Error(), "404") {
        // already deleted elsewhere — safe to proceed / retry idempotently
        return nil
    }
    return err
}

Prevention

Treat delete-404 as success to keep Apply idempotent.
Use a write-scoped DO token.
Back off on 429s when removing many records in bulk.

When it happens

Trigger: Apply() with removals where deleteRecord(client, zone.Name(), domainRecord.ID) returns an error — record already deleted (404), domain missing (404 project/domain), token without write scope, or 429 rate limiting.

Common situations: External controllers deleted the record between List and Apply (404 on DELETE); zone/domain removed from DO account; read-only API token; burst of removals hitting DO rate limits.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3b65e4572b8d2bd8. Report an issue: GitHub.