Chapter 18. External DNS Operator

1. Check the name of an install plan by running the following command:

   $ oc -n external-dns-operator get sub external-dns-operator -o yaml | yq '.status.installplan.name'

   Example output

   install-zcvlr

2. Check if the status of an install plan is

   Complete

   by running the following command:

   $ oc -n external-dns-operator get ip <install_plan_name> -o yaml | yq '.status.phase'

   Example output

   Complete

3. View the status of the

   external-dns-operator

   deployment by running the following command:

   $ oc get -n external-dns-operator deployment/external-dns-operator

   Example output

   NAME                    READY     UP-TO-DATE   AVAILABLE   AGE
   external-dns-operator   1/1       1            1           23h

Procedure

1. View the logs of the External DNS Operator by running the following command:

   $ oc logs -n external-dns-operator deployment/external-dns-operator -c external-dns-operator

Procedure

1. Click Operators OperatorHub in the OpenShift Container Platform web console.
2. Click External DNS Operator. You can use the Filter by keyword text box or the filter list to search for External DNS Operator from the list of Operators.
3. Select the

   external-dns-operator

   namespace.
4. On the External DNS Operator page, click Install.

5. On the Install Operator page, ensure that you selected the following options:

   1. Update the channel as stable-v1.
   2. Installation mode as A specific name on the cluster.
   3. Installed namespace as

      external-dns-operator

      . If namespace

      external-dns-operator

      does not exist, it gets created during the Operator installation.
   4. Select Approval Strategy as Automatic or Manual. Approval Strategy is set to Automatic by default.
   5. Click Install.

Procedure

1. Create a

   Namespace

   object:

   1. Create a YAML file that defines the

      Namespace

      object:

      Example namespace.yaml file

      apiVersion: v1
      kind: Namespace
      metadata:
        name: external-dns-operator

   2. Create the

      Namespace

      object by running the following command:

      $ oc apply -f namespace.yaml

2. Create an

   OperatorGroup

   object:

   1. Create a YAML file that defines the

      OperatorGroup

      object:

      Example operatorgroup.yaml file

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: external-dns-operator
        namespace: external-dns-operator
      spec:
        upgradeStrategy: Default
        targetNamespaces:
        - external-dns-operator

   2. Create the

      OperatorGroup

      object by running the following command:

      $ oc apply -f operatorgroup.yaml

3. Create a

   Subscription

   object:

   1. Create a YAML file that defines the

      Subscription

      object:

      Example subscription.yaml file

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: external-dns-operator
        namespace: external-dns-operator
      spec:
        channel: stable-v1
        installPlanApproval: Automatic
        name: external-dns-operator
        source: redhat-operators
        sourceNamespace: openshift-marketplace

   2. Create the

      Subscription

      object by running the following command:

      $ oc apply -f subscription.yaml

Verification

1. Get the name of the install plan from the subscription by running the following command:

   $ oc -n external-dns-operator \
       get subscription external-dns-operator \
       --template='{{.status.installplan.name}}{{"\n"}}'

2. Verify that the status of the install plan is

   Complete

   by running the following command:

   $ oc -n external-dns-operator \
       get ip <install_plan_name> \
       --template='{{.status.phase}}{{"\n"}}'

3. Verify that the status of the

   external-dns-operator

   pod is

   Running

   by running the following command:

   $ oc -n external-dns-operator get pod

   Example output

   NAME                                     READY   STATUS    RESTARTS   AGE
   external-dns-operator-5584585fd7-5lwqm   2/2     Running   0          11m

4. Verify that the catalog source of the subscription is

   redhat-operators

   by running the following command:

   $ oc -n external-dns-operator get subscription

   Example output

   NAME                    PACKAGE                 SOURCE             CHANNEL
   external-dns-operator   external-dns-operator   redhat-operators   stable-v1

5. Check the

   external-dns-operator

   version by running the following command:

   $ oc -n external-dns-operator get csv

   Example output

   NAME                           DISPLAY                VERSION   REPLACES   PHASE
   external-dns-operator.v<1.y.z>   ExternalDNS Operator   <1.y.z>                Succeeded

Procedure

1. Check the user. The user must have access to the

   kube-system

   namespace. If you don’t have the credentials, as you can fetch the credentials from the

   kube-system

   namespace to use the cloud provider client:

   $ oc whoami

   Example output

   system:admin

2. Fetch the values from aws-creds secret present in

   kube-system

   namespace.

   $ export AWS_ACCESS_KEY_ID=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_access_key_id}} | base64 -d)
   $ export AWS_SECRET_ACCESS_KEY=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_secret_access_key}} | base64 -d)

3. Get the routes to check the domain:

   $ oc get routes --all-namespaces | grep console

   Example output

   openshift-console          console             console-openshift-console.apps.testextdnsoperator.apacshift.support                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.testextdnsoperator.apacshift.support                     downloads           http    edge/Redirect          None

4. Get the list of dns zones to find the one which corresponds to the previously found route’s domain:

   $ aws route53 list-hosted-zones | grep testextdnsoperator.apacshift.support

   Example output

   HOSTEDZONES	terraform	/hostedzone/Z02355203TNN1XXXX1J6O	testextdnsoperator.apacshift.support.	5

5. Create

   ExternalDNS

   resource for

   route

   source:

   $ cat <<EOF | oc create -f -
   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-aws 

   1

   
   spec:
     domains:
     - filterType: Include   

   2

   
       matchType: Exact   

   3

   
       name: testextdnsoperator.apacshift.support 

   4

   
     provider:
       type: AWS 

   5

   
     source:  

   6

   
       type: OpenShiftRoute 

   7

   
       openshiftRouteOptions:
         routerName: default 

   8

   
   EOF

   1

   Defines the name of external DNS resource.

   2

   By default all hosted zones are selected as potential targets. You can include a hosted zone that you need.

   3

   The matching of the target zone’s domain has to be exact (as opposed to regular expression match).

   4

   Specify the exact domain of the zone you want to update. The hostname of the routes must be subdomains of the specified domain.

   5

   Defines the AWS Route53 DNS provider.

   6

   Defines options for the source of DNS records.

   7

   Defines OpenShift route resource as the source for the DNS records which gets created in the previously specified DNS provider.

   8

   If the source is OpenShiftRoute, then you can pass the OpenShift Ingress Controller name. External DNS Operator selects the canonical hostname of that router as the target while creating CNAME record.

6. Check the records created for OCP routes using the following command:

   $ aws route53 list-resource-record-sets --hosted-zone-id Z02355203TNN1XXXX1J6O --query "ResourceRecordSets[?Type == 'CNAME']" | grep console

Procedure

1. Get the Role ARN of the IAM Role that you created to allow Account B to access Account A’s Route 53 hosted zone by running the following command:

   $ aws --profile account-a iam get-role --role-name user-rol1 | head -1

   Example output

   ROLE	arn:aws:iam::1234567890123:role/user-rol1	2023-09-14T17:21:54+00:00	3600	/	AROA3SGB2ZRKRT5NISNJN	user-rol1

2. Locate the private hosted zone to use with Account A’s credentials by running the following command:

   $ aws --profile account-a route53 list-hosted-zones | grep testextdnsoperator.apacshift.support

   Example output

   HOSTEDZONES	terraform	/hostedzone/Z02355203TNN1XXXX1J6O	testextdnsoperator.apacshift.support. 5

3. Create the

   ExternalDNS

   object by running the following command:

   $ cat <<EOF | oc create -f -
   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-aws
   spec:
     domains:
     - filterType: Include
       matchType: Exact
       name: testextdnsoperator.apacshift.support
     provider:
       type: AWS
       aws:
         assumeRole:
           arn: arn:aws:iam::12345678901234:role/user-rol1 

   1

   
     source:
       type: OpenShiftRoute
       openshiftRouteOptions:
         routerName: default
   EOF

   1

   Specify the Role ARN to have DNS records created in Account A.

4. Check the records created for OpenShift Container Platform (OCP) routes by using the following command:

   $ aws --profile account-a route53 list-resource-record-sets --hosted-zone-id Z02355203TNN1XXXX1J6O --query "ResourceRecordSets[?Type == 'CNAME']" | grep console-openshift-console

Procedure

1. Fetch the credentials from the

   kube-system

   namespace to use the cloud provider client by running the following command:

   $ CLIENT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_id}} | base64 -d)

   $ CLIENT_SECRET=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_secret}} | base64 -d)

   $ RESOURCE_GROUP=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_resourcegroup}} | base64 -d)

   $ SUBSCRIPTION_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_subscription_id}} | base64 -d)

   $ TENANT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_tenant_id}} | base64 -d)

2. Log in to Azure by running the following command:

   $ az login --service-principal -u "${CLIENT_ID}" -p "${CLIENT_SECRET}" --tenant "${TENANT_ID}"

3. Get a list of routes by running the following command:

   $ oc get routes --all-namespaces | grep console

   Example output

   openshift-console          console             console-openshift-console.apps.test.azure.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.azure.example.com                     downloads           http    edge/Redirect          None

4. Get a list of DNS zones by running the following command:

   $ az network dns zone list --resource-group "${RESOURCE_GROUP}"

5. Create a YAML file, for example,

   external-dns-sample-azure.yaml

   , that defines the

   ExternalDNS

   object:

   Example external-dns-sample-azure.yaml file

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-azure 

   1

   
   spec:
     zones:
     - "/subscriptions/1234567890/resourceGroups/test-azure-xxxxx-rg/providers/Microsoft.Network/dnszones/test.azure.example.com" 

   2

   
     provider:
       type: Azure 

   3

   
     source:
       openshiftRouteOptions: 

   4

   
         routerName: default 

   5

   
       type: OpenShiftRoute 

   6

   1

   Specifies the External DNS name.

   2

   Defines the zone ID.

   3

   Defines the provider type.

   4

   You can define options for the source of DNS records.

   5

   If the source type is OpenShiftRoute, you can pass the OpenShift Ingress Controller name. External DNS selects the canonical hostname of that router as the target while creating CNAME record.

   6

   Defines the route resource as the source for the Azure DNS records.

6. Check the DNS records created for OpenShift Container Platform routes by running the following command:

   $ az network dns record-set list -g "${RESOURCE_GROUP}"  -z test.azure.example.com | grep console

   Note

   To create records on private hosted zones on private Azure DNS, you need to specify the private zone under the

   zones

   field which populates the provider type to

   azure-private-dns

   in the

   ExternalDNS

   container arguments.

Procedure

1. Copy the

   gcp-credentials

   secret in the

   encoded-gcloud.json

   file by running the following command:

   $ oc get secret gcp-credentials -n kube-system --template='{{$v := index .data "service_account.json"}}{{$v}}' | base64 -d - > decoded-gcloud.json

2. Export your Google credentials by running the following command:

   $ export GOOGLE_CREDENTIALS=decoded-gcloud.json

3. Activate your account by using the following command:

   $ gcloud auth activate-service-account  <client_email as per decoded-gcloud.json> --key-file=decoded-gcloud.json

4. Set your project by running the following command:

   $ gcloud config set project <project_id as per decoded-gcloud.json>

5. Get a list of routes by running the following command:

   $ oc get routes --all-namespaces | grep console

   Example output

   openshift-console          console             console-openshift-console.apps.test.gcp.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.gcp.example.com                     downloads           http    edge/Redirect          None

6. Get a list of managed zones by running the following command:

   $ gcloud dns managed-zones list | grep test.gcp.example.com

   Example output

   qe-cvs4g-private-zone test.gcp.example.com

7. Create a YAML file, for example,

   external-dns-sample-gcp.yaml

   , that defines the

   ExternalDNS

   object:

   Example external-dns-sample-gcp.yaml file

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-gcp 

   1

   
   spec:
     domains:
       - filterType: Include 

   2

   
         matchType: Exact 

   3

   
         name: test.gcp.example.com 

   4

   
     provider:
       type: GCP 

   5

   
     source:
       openshiftRouteOptions: 

   6

   
         routerName: default 

   7

   
       type: OpenShiftRoute 

   8

   1

   Specifies the External DNS name.

   2

   By default, all hosted zones are selected as potential targets. You can include your hosted zone.

   3

   The domain of the target must match the string defined by the name key.

   4

   Specify the exact domain of the zone you want to update. The hostname of the routes must be subdomains of the specified domain.

   5

   Defines the provider type.

   6

   You can define options for the source of DNS records.

   7

   If the source type is OpenShiftRoute, you can pass the OpenShift Ingress Controller name. External DNS selects the canonical hostname of that router as the target while creating CNAME record.

   8

   Defines the route resource as the source for Google Cloud DNS records.

8. Check the DNS records created for OpenShift Container Platform routes by running the following command:

   $ gcloud dns record-sets list --zone=qe-cvs4g-private-zone | grep console

Procedure

1. Create a

   secret

   object with Infoblox credentials by running the following command:

   $ oc -n external-dns-operator create secret generic infoblox-credentials --from-literal=EXTERNAL_DNS_INFOBLOX_WAPI_USERNAME=<infoblox_username> --from-literal=EXTERNAL_DNS_INFOBLOX_WAPI_PASSWORD=<infoblox_password>

2. Get a list of routes by running the following command:

   $ oc get routes --all-namespaces | grep console

   Example Output

   openshift-console          console             console-openshift-console.apps.test.example.com                       console             https   reencrypt/Redirect     None
   openshift-console          downloads           downloads-openshift-console.apps.test.example.com                     downloads           http    edge/Redirect          None

3. Create a YAML file, for example,

   external-dns-sample-infoblox.yaml

   , that defines the

   ExternalDNS

   object:

   Example external-dns-sample-infoblox.yaml file

   apiVersion: externaldns.olm.openshift.io/v1beta1
   kind: ExternalDNS
   metadata:
     name: sample-infoblox 

   1

   
   spec:
     provider:
       type: Infoblox 

   2

   
       infoblox:
         credentials:
           name: infoblox-credentials
         gridHost: ${INFOBLOX_GRID_PUBLIC_IP}
         wapiPort: 443
         wapiVersion: "2.3.1"
     domains:
     - filterType: Include
       matchType: Exact
       name: test.example.com
     source:
       type: OpenShiftRoute 

   3

   
       openshiftRouteOptions:
         routerName: default 

   4

   1

   Specifies the External DNS name.

   2

   Defines the provider type.

   3

   You can define options for the source of DNS records.

   4

   If the source type is OpenShiftRoute, you can pass the OpenShift Ingress Controller name. External DNS selects the canonical hostname of that router as the target while creating CNAME record.

4. Create the

   ExternalDNS

   resource on Infoblox by running the following command:

   $ oc create -f external-dns-sample-infoblox.yaml

5. From the Infoblox UI, check the DNS records created for

   console

   routes:
   1. Click Data Management DNS Zones.
   2. Select the zone name.

Procedure

1. Create the config map to contain the CA bundle in the

   external-dns-operator

   namespace by running the following command:

   $ oc -n external-dns-operator create configmap trusted-ca

2. To inject the trusted CA bundle into the config map, add the

   config.openshift.io/inject-trusted-cabundle=true

   label to the config map by running the following command:

   $ oc -n external-dns-operator label cm trusted-ca config.openshift.io/inject-trusted-cabundle=true

3. Update the subscription of the External DNS Operator by running the following command:

   $ oc -n external-dns-operator patch subscription external-dns-operator --type='json' -p='[{"op": "add", "path": "/spec/config", "value":{"env":[{"name":"TRUSTED_CA_CONFIGMAP_NAME","value":"trusted-ca"}]}}]'