Chapter 16. External DNS Operator

1. Check the name of an install plan:

   $ oc -n external-dns-operator get sub external-dns-operator -o yaml | yq '.status.installplan.name'

   Copy to Clipboard Toggle word wrap

   Example output

   install-zcvlr

   Copy to Clipboard Toggle word wrap

2. Check the status of an install plan, the status of an install plan must be Complete:

   $ oc -n external-dns-operator get ip <install_plan_name> -o yaml | yq '.status.phase'

   Copy to Clipboard Toggle word wrap

   Example output

   Complete

   Copy to Clipboard Toggle word wrap

3. Use the oc get command to view the Deployment status:

   $ oc get -n external-dns-operator deployment/external-dns-operator

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                    READY     UP-TO-DATE   AVAILABLE   AGE
   external-dns-operator   1/1       1            1           23h

   Copy to Clipboard Toggle word wrap

Procedure

1. View the logs of the External DNS Operator:

   $ oc logs -n external-dns-operator deployment/external-dns-operator -c external-dns-operator

   Copy to Clipboard Toggle word wrap

Procedure

1. Click Operators OperatorHub in the OpenShift Container Platform Web Console.
2. Click External DNS Operator. You can use the Filter by keyword text box or the filter list to search for External DNS Operator from the list of Operators.
3. Select the external-dns-operator namespace.
4. On the External DNS Operator page, click Install.

5. On the Install Operator page, ensure that you selected the following options:

   1. Update the channel as stable-v1.0.
   2. Installation mode as A specific name on the cluster.
   3. Installed namespace as external-dns-operator. If namespace external-dns-operator does not exist, it gets created during the Operator installation.
   4. Select Approval Strategy as Automatic or Manual. Approval Strategy is set to Automatic by default.
   5. Click Install.

Procedure

1. Check the user. The user must have access to the kube-system namespace. If you don’t have the credentials, as you can fetch the credentials from the kube-system namespace to use the cloud provider client:

   $ oc whoami

   Copy to Clipboard Toggle word wrap

   Example output

   system:admin

   Copy to Clipboard Toggle word wrap

2. Fetch the values from aws-creds secret present in kube-system namespace.

   $ export AWS_ACCESS_KEY_ID=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_access_key_id}} | base64 -d)
   $ export AWS_SECRET_ACCESS_KEY=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_secret_access_key}} | base64 -d)

   Copy to Clipboard Toggle word wrap

3. Get the routes to check the domain:

   $ oc get routes --all-namespaces | grep console

   Copy to Clipboard Toggle word wrap

   Example output

   openshift-console          console             console-openshift-console.apps.testextdnsoperator.apacshift.support                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.testextdnsoperator.apacshift.support                     downloads           http    edge/Redirect          None

   Copy to Clipboard Toggle word wrap

4. Get the list of dns zones to find the one which corresponds to the previously found route’s domain:

   $ aws route53 list-hosted-zones | grep testextdnsoperator.apacshift.support

   Copy to Clipboard Toggle word wrap

   Example output

   HOSTEDZONES	terraform	/hostedzone/Z02355203TNN1XXXX1J6O	testextdnsoperator.apacshift.support.	5

   Copy to Clipboard Toggle word wrap

5. Create ExternalDNS resource for route source:

   $ cat <<EOF | oc create -f -
   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-aws 

   1

   
   spec:
     domains:
     - filterType: Include   

   2

   
       matchType: Exact   

   3

   
       name: testextdnsoperator.apacshift.support 

   4

   
     provider:
       type: AWS 

   5

   
     source:  

   6

   
       type: OpenShiftRoute 

   7

   
       openshiftRouteOptions:
         routerName: default 

   8

   
   EOF

   Copy to Clipboard Toggle word wrap

   1

   Defines the name of external DNS resource.

   2

   By default all hosted zones are selected as potential targets. You can include a hosted zone that you need.

   3

   The matching of the target zone’s domain has to be exact (as opposed to regular expression match).

   4

   Specify the exact domain of the zone you want to update. The hostname of the routes must be subdomains of the specified domain.

   5

   Defines the AWS Route53 DNS provider.

   6

   Defines options for the source of DNS records.

   7

   Defines OpenShift route resource as the source for the DNS records which gets created in the previously specified DNS provider.

   8

   If the source is OpenShiftRoute, then you can pass the OpenShift Ingress Controller name. External DNS Operator selects the canonical hostname of that router as the target while creating CNAME record.

6. Check the records created for OCP routes using the following command:

   $ aws route53 list-resource-record-sets --hosted-zone-id Z02355203TNN1XXXX1J6O --query "ResourceRecordSets[?Type == 'CNAME']" | grep console

   Copy to Clipboard Toggle word wrap

Procedure

1. Check the user. The user must have access to the kube-system namespace. If you don’t have the credentials, as you can fetch the credentials from the kube-system namespace to use the cloud provider client:

   $ oc whoami

   Copy to Clipboard Toggle word wrap

   Example output

   system:admin

   Copy to Clipboard Toggle word wrap

2. Fetch the values from azure-credentials secret present in kube-system namespace.

   $ CLIENT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_id}} | base64 -d)
   $ CLIENT_SECRET=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_secret}} | base64 -d)
   $ RESOURCE_GROUP=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_resourcegroup}} | base64 -d)
   $ SUBSCRIPTION_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_subscription_id}} | base64 -d)
   $ TENANT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_tenant_id}} | base64 -d)

   Copy to Clipboard Toggle word wrap

3. Login to azure with base64 decoded values:

   $ az login --service-principal -u "${CLIENT_ID}" -p "${CLIENT_SECRET}" --tenant "${TENANT_ID}"

   Copy to Clipboard Toggle word wrap

4. Get the routes to check the domain:

   $ oc get routes --all-namespaces | grep console

   Copy to Clipboard Toggle word wrap

   Example output

   openshift-console          console             console-openshift-console.apps.test.azure.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.azure.example.com                     downloads           http    edge/Redirect          None

   Copy to Clipboard Toggle word wrap

5. Get the list of dns zones to find the one which corresponds to the previously found route’s domain:

   $ az network dns zone list --resource-group "${RESOURCE_GROUP}"

   Copy to Clipboard Toggle word wrap

6. Create ExternalDNS resource for route source:

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-azure 

   1

   
   spec:
     zones:
     - "/subscriptions/1234567890/resourceGroups/test-azure-xxxxx-rg/providers/Microsoft.Network/dnszones/test.azure.example.com" 

   2

   
     provider:
       type: Azure 

   3

   
     source:
       openshiftRouteOptions: 

   4

   
         routerName: default 

   5

   
       type: OpenShiftRoute 

   6

   
   EOF

   Copy to Clipboard Toggle word wrap

   1

   Specifies the name of External DNS CR.

   2

   Define the zone ID.

   3

   Defines the Azure DNS provider.

   4

   You can define options for the source of DNS records.

   5

   If the source is OpenShiftRoute then you can pass the OpenShift Ingress Controller name. External DNS selects the canonical hostname of that router as the target while creating CNAME record.

   6

   Defines OpenShift route resource as the source for the DNS records which gets created in the previously specified DNS provider.

7. Check the records created for OCP routes using the following command:

   $ az network dns record-set list -g "${RESOURCE_GROUP}"  -z test.azure.example.com | grep console

   Copy to Clipboard Toggle word wrap
   Note

   To create records on private hosted zones on private Azure dns, you need to specify the private zone under zones which populates the provider type to azure-private-dns in the ExternalDNS container args.

Procedure

1. Check the user. The user must have access to the kube-system namespace. If you don’t have the credentials, as you can fetch the credentials from the kube-system namespace to use the cloud provider client:

   $ oc whoami

   Copy to Clipboard Toggle word wrap

   Example output

   system:admin

   Copy to Clipboard Toggle word wrap

2. Copy the value of service_account.json in gcp-credentials secret in a file encoded-gcloud.json by running the following command:

   $ oc get secret gcp-credentials -n kube-system --template='{{$v := index .data "service_account.json"}}{{$v}}' | base64 -d - > decoded-gcloud.json

   Copy to Clipboard Toggle word wrap

3. Export Google credentials:

   $ export GOOGLE_CREDENTIALS=decoded-gcloud.json

   Copy to Clipboard Toggle word wrap

4. Activate your account by using the following command:

   $ gcloud auth activate-service-account  <client_email as per decoded-gcloud.json> --key-file=decoded-gcloud.json

   Copy to Clipboard Toggle word wrap

5. Set your project:

   $ gcloud config set project <project_id as per decoded-gcloud.json>

   Copy to Clipboard Toggle word wrap

6. Get the routes to check the domain:

   $ oc get routes --all-namespaces | grep console

   Copy to Clipboard Toggle word wrap

   Example output

   openshift-console          console             console-openshift-console.apps.test.gcp.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.gcp.example.com                     downloads           http    edge/Redirect          None

   Copy to Clipboard Toggle word wrap

7. Get the list of managed zones to find the zone which corresponds to the previously found route’s domain:

   $ gcloud dns managed-zones list | grep test.gcp.example.com
   qe-cvs4g-private-zone test.gcp.example.com

   Copy to Clipboard Toggle word wrap

8. Create ExternalDNS resource for route source:

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-gcp 

   1

   
   spec:
     domains:
       - filterType: Include 

   2

   
         matchType: Exact 

   3

   
         name: test.gcp.example.com 

   4

   
     provider:
       type: GCP 

   5

   
     source:
       openshiftRouteOptions: 

   6

   
         routerName: default 

   7

   
       type: OpenShiftRoute 

   8

   
   EOF

   Copy to Clipboard Toggle word wrap

   1

   Specifies the name of External DNS CR.

   2

   By default all hosted zones are selected as potential targets. You can include a hosted zone that you need.

   3

   The matching of the target zone’s domain has to be exact (as opposed to regular expression match).

   4

   Specify the exact domain of the zone you want to update. The hostname of the routes must be subdomains of the specified domain.

   5

   Defines Google Cloud DNS provider.

   6

   You can define options for the source of DNS records.

   7

   If the source is OpenShiftRoute then you can pass the OpenShift Ingress Controller name. External DNS selects the canonical hostname of that router as the target while creating CNAME record.

   8

   Defines OpenShift route resource as the source for the DNS records which gets created in the previously specified DNS provider.

9. Check the records created for OCP routes using the following command:

   $ gcloud dns record-sets list --zone=qe-cvs4g-private-zone | grep console

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a secret object with Infoblox credentials by running the following command:

   $ oc -n external-dns-operator create secret generic infoblox-credentials --from-literal=EXTERNAL_DNS_INFOBLOX_WAPI_USERNAME=<infoblox_username> --from-literal=EXTERNAL_DNS_INFOBLOX_WAPI_PASSWORD=<infoblox_password>

   Copy to Clipboard Toggle word wrap

2. Get the routes objects to check your cluster domain by running the following command:

   $ oc get routes --all-namespaces | grep console

   Copy to Clipboard Toggle word wrap

   Example Output

   openshift-console          console             console-openshift-console.apps.test.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.example.com                     downloads           http    edge/Redirect          None

   Copy to Clipboard Toggle word wrap

3. Create an ExternalDNS resource YAML file, for example, sample-infoblox.yaml, as follows:

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-infoblox
   spec:
     provider:
       type: Infoblox
       infoblox:
         credentials:
           name: infoblox-credentials
         gridHost: ${INFOBLOX_GRID_PUBLIC_IP}
         wapiPort: 443
         wapiVersion: "2.3.1"
     domains:
     - filterType: Include
       matchType: Exact
       name: test.example.com
     source:
       type: OpenShiftRoute
       openshiftRouteOptions:
         routerName: default

   Copy to Clipboard Toggle word wrap

4. Create an ExternalDNS resource on Infoblox by running the following command:

   $ oc create -f sample-infoblox.yaml

   Copy to Clipboard Toggle word wrap

5. From the Infoblox UI, check the DNS records created for console routes:

   1. Click Data Management DNS Zones.
   2. Select the zone name.

Procedure

1. Create the config map to contain the CA bundle in the external-dns-operator namespace by running the following command:

   $ oc -n external-dns-operator create configmap trusted-ca

   Copy to Clipboard Toggle word wrap

2. To inject the trusted CA bundle into the config map, add the config.openshift.io/inject-trusted-cabundle=true label to the config map by running the following command:

   $ oc -n external-dns-operator label cm trusted-ca config.openshift.io/inject-trusted-cabundle=true

   Copy to Clipboard Toggle word wrap

3. Update the subscription of the External DNS Operator by running the following command:

   $ oc -n external-dns-operator patch subscription external-dns-operator --type='json' -p='[{"op": "add", "path": "/spec/config", "value":{"env":[{"name":"TRUSTED_CA_CONFIGMAP_NAME","value":"trusted-ca"}]}}]'

   Copy to Clipboard Toggle word wrap