kubernetes/kops · error

zone does not support resource records %q

Error message

zone does not support resource records %q

What it means

getChangeset needs a ResourceRecordSets() interface from the zone. dnsprovider zones return (interface, bool); if ok is false, that provider's zone implementation cannot manage individual records, so getChangeset fails with 'zone does not support resource records %q'. This is a provider-capability error, not a record-level problem.

Source

Thrown at dns-controller/pkg/dns/dnscontroller.go:463

		zone := o.zones[zoneName]
		if zone != nil {
			return zone
		}
		dot := strings.IndexByte(zoneName, '.')
		if dot == -1 {
			return nil
		}
		zoneName = zoneName[dot+1:]
	}
}

func (o *dnsOp) getChangeset(zone dnsprovider.Zone) (dnsprovider.ResourceRecordChangeset, error) {
	key := zone.Name() + "::" + zone.ID()
	changeset := o.changesets[key]
	if changeset == nil {
		rrsProvider, ok := zone.ResourceRecordSets()
		if !ok {
			return nil, fmt.Errorf("zone does not support resource records %q", zone.Name())
		}
		changeset = rrsProvider.StartChangeset()
		o.changesets[key] = changeset
	}

	return changeset, nil
}

// listRecords is a wrapper around listing records, but will cache the results for the duration of the dnsOp
func (o *dnsOp) listRecords(zone dnsprovider.Zone) ([]dnsprovider.ResourceRecordSet, error) {
	key := zone.Name() + "::" + zone.ID()

	rrs := o.recordsCache[key]
	if rrs == nil {
		rrsProvider, ok := zone.ResourceRecordSets()
		if !ok {
			return nil, fmt.Errorf("zone does not support resource records %q", zone.Name())
		}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Switch to a fully supported --dns provider (aws-route53, google-clouddns, digitalocean, etc.) that implements ResourceRecordSets.
2. Check the dnsprovider driver for your backend: if ResourceRecordSets() is unimplemented, it needs a driver fix/upstream contribution.
3. Exclude record-hosting-incompatible zones from the controller's zone filters so they are never selected via findZone.

Example fix

// before
--dns=cloudless   // provider whose zones do not support record sets
// after
--dns=aws-route53

// guard before requesting a changeset
func zoneSupportsRecords(zone dnsprovider.Zone) bool {
    _, ok := zone.ResourceRecordSets()
    return ok
}
if !zoneSupportsRecords(zone) {
    return fmt.Errorf("skip zone %s: no record-set support", zone.Name())
}

func hasRecordSets(zone dnsprovider.Zone) (dnsprovider.ResourceRecordSets, bool) {
    return zone.ResourceRecordSets() // (interface, ok) narrowing built into the API
}

cs, err := o.getChangeset(zone)
if err != nil {
    if strings.Contains(err.Error(), "does not support resource records") {
        klog.Warningf("provider driver lacks record support for %s; switch --dns provider", zone.Name())
        return
    }
    return err
}

When it happens

Trigger: o.getChangeset(zone) called from deleteRecords/updateRecords on a zone whose dnsprovider implementation returns false from ResourceRecordSets() — i.e., a zone type lacking record-set support in the provider driver.

Common situations: Using a dns-provider backend whose kops driver only implements zone listing (incomplete/limited provider support); misconfigured --dns flag selecting a provider that cannot host the records; a stub/mock provider in tests.

Related errors

• DNS provider does not support zones
• error querying for DNS zones: %v
• error initializing DNS cache: %v
• error applying DNS changeset for zone %s: %v
• error querying for zones: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/887142e761a3ad8e. Report an issue: GitHub.