kubernetes/kops · error

failed to list dns zones: %s

Error message

failed to list dns zones: %s

What it means

In the OpenStack resource cleanup, ListDNSRecordsets first lists DNS zones via the OpenStack Designate client. If ListDNSZones fails, the error is wrapped with this message and returned. It means the Designate API request for zones failed.

Source

Thrown at pkg/resources/openstack/dns.go:40

	"github.com/gophercloud/gophercloud/v2/openstack/dns/v2/zones"
	"k8s.io/kops/pkg/resources"
	"k8s.io/kops/upup/pkg/fi"
)

const (
	typeDNSRecord = "DNSRecord"
)

func (os *clusterDiscoveryOS) ListDNSRecordsets() ([]*resources.Resource, error) {
	// Designate is optional in OpenStack.
	if os.osCloud.DNSClient() == nil {
		return nil, nil
	}

	zs, err := os.osCloud.ListDNSZones(zones.ListOpts{})
	if err != nil {
		return nil, fmt.Errorf("failed to list dns zones: %s", err)
	}

	var clusterZone zones.Zone
	for _, zone := range zs {
		if strings.HasSuffix(os.clusterName, strings.TrimSuffix(zone.Name, ".")) {
			clusterZone = zone
			break
		}
	}

	if clusterZone.ID == "" {
		return nil, fmt.Errorf("failed to find cluster dns zone")
	}

	rrs, err := os.osCloud.ListDNSRecordsets(clusterZone.ID, nil)
	if err != nil {
		return nil, fmt.Errorf("failed to extract recordsets pages for zone %s: %v", clusterZone.Name, err)
	}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify OpenStack credentials (OS_USERNAME/OS_PASSWORD/OS_PROJECT/OS_AUTH_URL) via 'openstack zone list'
2. Confirm the Designate service endpoint exists in the catalog
3. Re-source the correct openrc file
4. Check project RBAC allows listing DNS zones
5. Retry after transient network/auth errors

Example fix

// before
zs, err := os.osCloud.ListDNSZones(zones.ListOpts{})
if err != nil {
	return nil, fmt.Errorf("failed to list dns zones: %s", err)
}
// after
zs, err := os.osCloud.ListDNSZones(zones.ListOpts{})
if err != nil {
	return nil, fmt.Errorf("failed to list dns zones: %w", err)
}

# Verify credentials and Designate access before running kops delete
openstack zone list || echo "fix OS_* credentials / Designate endpoint"

func isAuthError(err error) bool { _, ok := err.(gophercloud.ErrDefault401); return ok }

zs, err := os.osCloud.ListDNSZones(zones.ListOpts{})
if err != nil {
	return nil, fmt.Errorf("failed to list dns zones: %w", err)
}

When it happens

Trigger: os.osCloud.ListDNSZones(zones.ListOpts{}) errors: missing/invalid OpenStack credentials, no access to the DNS service endpoint, network failure, or Keystone auth token expired.

Common situations: Designate not deployed in the cloud (endpoint missing), OS_* environment variables unset or wrong project, expired tokens, DNS service quotas or RBAC denying zone listing.

Related errors

• failed to extract recordsets pages for zone %s: %v
• failed to find cluster dns zone
• error building dns client: %w
• error building (Designate) DNS provider: %v
• failed to list dns zones: %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/cf1baef278894897. Report an issue: GitHub.