kubernetes/kops · warning

no suitable zone found for %q

Error message

no suitable zone found for %q

What it means

deleteRecords resolves the hosted zone for a record's FQDN via findZone. If no zone in the controller's zone list matches the FQDN suffix, it returns 'no suitable zone found for %q' and skips deletion. The controller only manages records inside zones it can see, so a mismatch between the record's domain and the visible zones triggers this.

Source

Thrown at dns-controller/pkg/dns/dnscontroller.go:504

		if err != nil {
			return nil, fmt.Errorf("error querying resource records for zone %q: %v", zone.Name(), err)
		}

		o.recordsCache[key] = rrs
	}

	return rrs, nil
}

func (o *dnsOp) deleteRecords(k recordKey) error {
	klog.V(2).Infof("Deleting all records for %s", k)

	fqdn := EnsureDotSuffix(k.FQDN)

	zone := o.findZone(fqdn)
	if zone == nil {
		// TODO: Post event into service / pod
		return fmt.Errorf("no suitable zone found for %q", fqdn)
	}

	// when DNS provider is aws-route53 or google-clouddns
	rrs, err := o.listRecords(zone)
	if err != nil {
		return fmt.Errorf("error querying resource records for zone %q: %v", zone.Name(), err)
	}

	cs, err := o.getChangeset(zone)
	if err != nil {
		return err
	}

	for _, rr := range rrs {
		rrName := EnsureDotSuffix(rr.Name())
		if rrName != fqdn {
			klog.V(8).Infof("Skipping delete of record %q (name != %s)", rrName, fqdn)
			continue

View on GitHub (pinned to 4c8573c808)

Solutions

1. Verify the FQDN in the pod/service/ingress annotation matches (is a subdomain of) an actual hosted zone visible to the controller.
2. Remove or widen --zone/--zoneid flags so the matching zone is included in zone discovery.
3. Ensure the zone exists and the controller's credentials can list it (route53:ListHostedZones).
4. Correct the annotation domain (e.g. internal.example.org -> internal.example.com) to the real zone suffix.

Example fix

// before: ingress annotation
external-dns.alpha.kubernetes.io/hostname: app.example.org   // zone example.org not in this account
// after: point at a hosted zone the controller manages
external-dns.alpha.kubernetes.io/hostname: app.example.com

// before annotating a service/ingress, confirm the FQDN is inside a managed zone
zones, _ := dnsCache.ListZones(zoneListCacheValidity)
fqdn := "app.example.org"
var managed bool
for _, z := range zones {
    if strings.HasSuffix(fqdn, strings.TrimSuffix(z.Name(), ".")) {
        managed = true
    }
}
if !managed {
    klog.Warningf("%s is not within any visible hosted zone; record will not be managed", fqdn)
}

if err := deleteRecords(keys); err != nil {
    if strings.Contains(err.Error(), "no suitable zone found") {
        klog.Warningf("orphaned record outside managed zones: %v", err) // requires manual cleanup
        return
    }
    return err
}

When it happens

Trigger: deleteRecords for hostname k whose EnsureDotSuffix(k.FQDN) is not a suffix of any zone returned by ListZones: e.g. record 'app.example.org' but the account only holds 'example.com'; or zone filters (--zone/--zoneid) excluded the matching zone.

Common situations: Service/ingress annotation uses a FQDN outside the hosted zones; wrong hosted zone in the account; --zone flags restricting the controller; zone deleted/renamed after records were created; typo in annotation domain.

Related errors

• DNS provider does not support zones
• error querying for DNS zones: %v
• error initializing DNS cache: %v
• error applying DNS changeset for zone %s: %v
• error querying for zones: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/33187a93c1725fa2. Report an issue: GitHub.