No matching hosted zones found for %q; please create one (e.

Error message

No matching hosted zones found for %q; please create one (e.g. %q) first

What it means

FindDNSHostedZone filters listed zones to those whose name is a suffix of the cluster DNS name, keeping the longest matches. If no existing hosted zone matches the cluster's domain at all, kops refuses to proceed because DNS delegation must be set up manually; the error suggests the registrable parent domain (last two labels) to create.

Source

Thrown at upup/pkg/fi/cloudup/utils.go:301

		if n < maxLength {
			continue
		}

		if n > maxLength {
			maxLength = n
			maxLengthZones = []dnsprovider.Zone{}
		}

		maxLengthZones = append(maxLengthZones, z)
	}

	if len(maxLengthZones) == 0 {
		// We make this an error because you have to set up DNS delegation anyway
		tokens := strings.Split(clusterDNSName, ".")
		suffix := strings.Join(tokens[len(tokens)-2:], ".")
		// klog.Warningf("No matching hosted zones found; will created %q", suffix)
		// return suffix, nil
		return "", fmt.Errorf("No matching hosted zones found for %q; please create one (e.g. %q) first", clusterDNSName, suffix)
	}

	if len(maxLengthZones) == 1 {
		id := maxLengthZones[0].ID()
		id = strings.TrimPrefix(id, "/hostedzone/")
		return id, nil
	}

	return "", fmt.Errorf("Found multiple hosted zones matching cluster %q; please specify the ID of the zone to use", clusterDNSName)
}

View on GitHub (pinned to 4c8573c808)

Solutions

Create a hosted zone for the parent domain, e.g. `aws route53 create-hosted-zone --name example.com --caller-reference $(uuidgen)`, then add NS records at your registrar.
Or create a zone matching the cluster subdomain exactly (cluster.example.com).
Double-check the cluster --name matches the domain you actually control and that credentials point at the account owning the zone.

Example fix

// before (no zone exists)
kops create cluster --name cluster.example.com ...
// after
aws route53 create-hosted-zone --name example.com --caller-reference ref-123
kops create cluster --name cluster.example.com ...

Defensive patterns

Strategy: validation

Validate before calling

id, err := findZoneID(clusterDNSName) // pre-check zone exists via provider API before kops
if err != nil { createHostedZone(parentDomain(clusterDNSName)) }

Prevention

Create the hosted zone for the cluster's parent domain before `kops create cluster`.
Keep cluster --name inside a domain you control in the same account kops authenticates to.
Store the zone ID in cluster.spec.dnsZone to make lookups deterministic.

When it happens

Trigger: `kops create cluster` or `update cluster` where the cluster DNS name (e.g. cluster.example.com) has no hosted zone covering example.com or cluster.example.com in the configured DNS account/provider.

Common situations: Fresh AWS account with no Route53 zone created for the domain; zone exists in a different AWS account than the credentials used; private vs public zone mismatch; typo in --name / cluster DNS name; using gossip-free setup without ever registering the domain.

Related errors

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/1eee8b40a5ca02cb. Report an issue: GitHub.