What causes "failed to list records for domain %s: %s" in kubernetes/kops?

Check the wrapped error for 401/429 and fix token scope or wait for rate-limit reset

failed to list records for domain %s: %s

Error message

failed to list records for domain %s: %s

What it means

Wraps an error from getAllRecordsByDomain when fetching all DNS records for the matched domain. The domain lookup succeeded but enumerating its records failed, so kOps cannot discover cluster DNS resources.

Source

Thrown at pkg/resources/digitalocean/resources.go:161

	domains, _, err := c.DomainService().List(context.TODO(), &godo.ListOptions{})
	if err != nil {
		return nil, fmt.Errorf("failed to list domains: %s", err)
	}

	var domainName string
	for _, domain := range domains {
		if strings.HasSuffix(clusterName, domain.Name) {
			domainName = domain.Name
		}
	}

	if domainName == "" {
		return nil, fmt.Errorf("failed to find domain for cluster: %s", clusterName)
	}

	records, err := getAllRecordsByDomain(c, domainName)
	if err != nil {
		return nil, fmt.Errorf("failed to list records for domain %s: %s", domainName, err)
	}

	var resourceTrackers []*resources.Resource
	for _, record := range records {
		if !strings.HasSuffix(dns.EnsureDotSuffix(record.Name)+domainName, clusterName) {
			continue
		}

		// kops for digitalocean should only create A records
		// in the future that may change but for now this provides a safe filter
		// in case users assign NS records for the cluster subdomain
		if record.Type != "A" {
			continue
		}

		resourceTracker := &resources.Resource{
			Name: record.Name,
			ID:   strconv.Itoa(record.ID),

View on GitHub (pinned to 4c8573c808)

Solutions

Check the wrapped error for 401/429 and fix token scope or wait for rate-limit reset
Retry the delete/dump operation
Verify domain still exists in the DO account (it may have been deleted between calls)
Check network connectivity to api.digitalocean.com

Example fix

// before
# 429 rate limit hit during record pagination
// after
export DIGITALOCEAN_ACCESS_TOKEN=<token with adequate limits>
kops delete cluster --name my.cluster --cloud digitalocean  # retry after backoff

Defensive patterns

Strategy: retry

Validate before calling

records, err := getAllRecordsByDomain(c, domainName)
if err != nil {
	if isRetryable(err) { records, err = retryWithBackoff(3, func() ([]do.Record, error) { return getAllRecordsByDomain(c, domainName) }) }
}

Try / catch

records, err := getAllRecordsByDomain(c, domainName)
if err != nil {
	return fmt.Errorf("failed to list records for domain %s: %w", domainName, err)
}

Prevention

Use backoff on 429 rate-limit errors during pagination
Ensure token keeps domain read scope throughout the operation
Avoid deleting the domain between listing and record fetching

When it happens

Trigger: getAllRecordsByDomain paginates godo DomainRecordsService().List; any API error (auth, network, rate limit) during pagination for domainName is wrapped here.

Common situations: Token read scope on domains granted but records listing blocked by permission changes; rate limiting when many records; transient network drop mid-pagination.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/51a71ced7c2f6524. Report an issue: GitHub.