Skip to content

Commit c49c061

Browse files
patrickdillonGrant Spence
patrickdillon
and
Grant Spence
committed
DNS: Add awsPrivateHostedZoneRole
Adds a field to the DNS config to hold a role to assume when performing cross- account installs in an AWS shared VPC environment. Co-authored-by: Grant Spence <gcs278@vt.edu> Co-authored-by: deads2k
1 parent f6e7dff commit c49c061

File tree

7 files changed

+429
-1
lines changed

7 files changed

+429
-1
lines changed

‎config/v1/0000_10_config-operator_01_dns-TechPreviewNoUpgrade.crd.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
api-approved.openshift.io: https://github.com/openshift/api/pull/470
6+
include.release.openshift.io/ibm-cloud-managed: "true"
7+
include.release.openshift.io/self-managed-high-availability: "true"
8+
include.release.openshift.io/single-node-developer: "true"
9+
release.openshift.io/feature-set: TechPreviewNoUpgrade
10+
name: dnses.config.openshift.io
11+
spec:
12+
group: config.openshift.io
13+
names:
14+
kind: DNS
15+
listKind: DNSList
16+
plural: dnses
17+
singular: dns
18+
scope: Cluster
19+
versions:
20+
- name: v1
21+
schema:
22+
openAPIV3Schema:
23+
description: "DNS holds cluster-wide information about DNS. The canonical name is `cluster` \n Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer)."
24+
type: object
25+
required:
26+
- spec
27+
properties:
28+
apiVersion:
29+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
30+
type: string
31+
kind:
32+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
33+
type: string
34+
metadata:
35+
type: object
36+
spec:
37+
description: spec holds user settable values for configuration
38+
type: object
39+
properties:
40+
baseDomain:
41+
description: "baseDomain is the base domain of the cluster. All managed DNS records will be sub-domains of this base. \n For example, given the base domain `openshift.example.com`, an API server DNS record may be created for `cluster-api.openshift.example.com`. \n Once set, this field cannot be changed."
42+
type: string
43+
platform:
44+
description: platform holds configuration specific to the underlying infrastructure provider for DNS. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time.
45+
type: object
46+
required:
47+
- type
48+
properties:
49+
aws:
50+
description: aws contains DNS configuration specific to the Amazon Web Services cloud provider.
51+
type: object
52+
properties:
53+
privateZoneIAMRole:
54+
description: privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.
55+
type: string
56+
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam:[0-9]{12}:role\/.*$
57+
type:
58+
description: "type is the underlying infrastructure provider for the cluster. Allowed values: \"\", \"AWS\". DNSPlatformType is a subset of Infrastructure PlatformType. \n Individual components may not support all platforms, and must handle unrecognized platforms with best-effort defaults."
59+
type: string
60+
enum:
61+
- ""
62+
- AWS
63+
- Azure
64+
- BareMetal
65+
- GCP
66+
- Libvirt
67+
- OpenStack
68+
- None
69+
- VSphere
70+
- oVirt
71+
- IBMCloud
72+
- KubeVirt
73+
- EquinixMetal
74+
- PowerVS
75+
- AlibabaCloud
76+
- Nutanix
77+
- External
78+
x-kubernetes-validations:
79+
- rule: self in ['','AWS']
80+
message: allowed values are '' and 'AWS'
81+
x-kubernetes-validations:
82+
- rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : !has(self.aws)'
83+
message: aws configuration is required when platform is AWS, and forbidden otherwise
84+
privateZone:
85+
description: "privateZone is the location where all the DNS records that are only available internally to the cluster exist. \n If this field is nil, no private records should be created. \n Once set, this field cannot be changed."
86+
type: object
87+
properties:
88+
id:
89+
description: "id is the identifier that can be used to find the DNS hosted zone. \n on AWS zone can be fetched using `ID` as id in [1] on Azure zone can be fetched using `ID` as a pre-determined name in [2], on GCP zone can be fetched using `ID` as a pre-determined name in [3]. \n [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get"
90+
type: string
91+
tags:
92+
description: "tags can be used to query the DNS hosted zone. \n on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, \n [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options"
93+
type: object
94+
additionalProperties:
95+
type: string
96+
publicZone:
97+
description: "publicZone is the location where all the DNS records that are publicly accessible to the internet exist. \n If this field is nil, no public records should be created. \n Once set, this field cannot be changed."
98+
type: object
99+
properties:
100+
id:
101+
description: "id is the identifier that can be used to find the DNS hosted zone. \n on AWS zone can be fetched using `ID` as id in [1] on Azure zone can be fetched using `ID` as a pre-determined name in [2], on GCP zone can be fetched using `ID` as a pre-determined name in [3]. \n [1]: https://docs.aws.amazon.com/cli/latest/reference/route53/get-hosted-zone.html#options [2]: https://docs.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest#az-network-dns-zone-show [3]: https://cloud.google.com/dns/docs/reference/v1/managedZones/get"
102+
type: string
103+
tags:
104+
description: "tags can be used to query the DNS hosted zone. \n on AWS, resourcegroupstaggingapi [1] can be used to fetch a zone using `Tags` as tag-filters, \n [1]: https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html#options"
105+
type: object
106+
additionalProperties:
107+
type: string
108+
status:
109+
description: status holds observed values from the cluster. They may not be overridden.
110+
type: object
111+
served: true
112+
storage: true
113+
subresources:
114+
status: {}

‎config/v1/techpreview.dns.testsuite.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "[TechPreview] DNS"
3+
crd: 0000_10_config-operator_01_dns-TechPreviewNoUpgrade.crd.yaml
4+
tests:
5+
onCreate:
6+
- name: Should be able to create a minimal DNS
7+
initial: |
8+
apiVersion: config.openshift.io/v1
9+
kind: DNS
10+
spec: {} # No spec is required for a DNS
11+
expected: |
12+
apiVersion: config.openshift.io/v1
13+
kind: DNS
14+
spec: {}
15+
- name: Should be able to specify an AWS role ARN for a private hosted zone
16+
initial: |
17+
apiVersion: config.openshift.io/v1
18+
kind: DNS
19+
spec:
20+
platform:
21+
type: AWS
22+
aws:
23+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
24+
expected: |
25+
apiVersion: config.openshift.io/v1
26+
kind: DNS
27+
spec:
28+
platform:
29+
type: AWS
30+
aws:
31+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
32+
- name: Should not be able to specify unsupported platform
33+
initial: |
34+
apiVersion: config.openshift.io/v1
35+
kind: DNS
36+
spec:
37+
platform:
38+
type: Azure
39+
azure:
40+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
41+
expectedError: "Invalid value: \"string\": allowed values are '' and 'AWS'"
42+
- name: Should not be able to specify invalid AWS role ARN
43+
initial: |
44+
apiVersion: config.openshift.io/v1
45+
kind: DNS
46+
metadata:
47+
name: cluster
48+
spec:
49+
platform:
50+
type: AWS
51+
aws:
52+
privateZoneIAMRole: arn:aws:iam:bad:123456789012:role/foo
53+
expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov):iam:[0-9]{12}:role\\/.*$'"
54+
- name: Should not be able to specify different type and platform
55+
initial: |
56+
apiVersion: config.openshift.io/v1
57+
kind: DNS
58+
spec:
59+
platform:
60+
type: ""
61+
aws:
62+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
63+
expectedError: "Invalid value: \"object\": aws configuration is required when platform is AWS, and forbidden otherwise"
64+
onUpdate:
65+
- name: Can switch from empty (default), to AWS
66+
initial: |
67+
apiVersion: config.openshift.io/v1
68+
kind: DNS
69+
spec:
70+
platform:
71+
type: ""
72+
updated: |
73+
apiVersion: config.openshift.io/v1
74+
kind: DNS
75+
spec:
76+
platform:
77+
type: AWS
78+
aws:
79+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
80+
expected: |
81+
apiVersion: config.openshift.io/v1
82+
kind: DNS
83+
spec:
84+
platform:
85+
type: AWS
86+
aws:
87+
privateZoneIAMRole: arn:aws:iam:123456789012:role/foo
88+
- name: Upgrade case is valid
89+
initial: |
90+
apiVersion: config.openshift.io/v1
91+
kind: DNS
92+
spec: {} # No spec is required for a DNS
93+
updated: |
94+
apiVersion: config.openshift.io/v1
95+
kind: DNS
96+
spec:
97+
platform:
98+
type: ""
99+
expected: |
100+
apiVersion: config.openshift.io/v1
101+
kind: DNS
102+
spec:
103+
platform:
104+
type: ""

‎config/v1/types_dns.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,13 @@ type DNSSpec struct {
5353
//
5454
// +optional
5555
PrivateZone *DNSZone `json:"privateZone,omitempty"`
56+
// platform holds configuration specific to the underlying
57+
// infrastructure provider for DNS.
58+
// When omitted, this means the user has no opinion and the platform is left
59+
// to choose reasonable defaults. These defaults are subject to change over time.
60+
// +openshift:enable:FeatureSets=TechPreviewNoUpgrade
61+
// +optional
62+
Platform DNSPlatformSpec `json:"platform,omitempty"`
5663
}
5764

5865
// DNSZone is used to define a DNS hosted zone.
@@ -96,3 +103,34 @@ type DNSList struct {
96103

97104
Items []DNS `json:"items"`
98105
}
106+
107+
// DNSPlatformSpec holds cloud-provider-specific configuration
108+
// for DNS administration.
109+
// +union
110+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws configuration is required when platform is AWS, and forbidden otherwise"
111+
type DNSPlatformSpec struct {
112+
// type is the underlying infrastructure provider for the cluster.
113+
// Allowed values: "", "AWS".
114+
//
115+
// Individual components may not support all platforms,
116+
// and must handle unrecognized platforms with best-effort defaults.
117+
//
118+
// +unionDiscriminator
119+
// +kubebuilder:validation:Required
120+
// +kubebuilder:validation:XValidation:rule="self in ['','AWS']",message="allowed values are '' and 'AWS'"
121+
Type PlatformType `json:"type"`
122+
123+
// aws contains DNS configuration specific to the Amazon Web Services cloud provider.
124+
// +optional
125+
AWS *AWSDNSSpec `json:"aws"`
126+
}
127+
128+
// AWSDNSSpec contains DNS configuration specific to the Amazon Web Services cloud provider.
129+
type AWSDNSSpec struct {
130+
// privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
131+
// operations on the cluster's private hosted zone specified in the cluster DNS config.
132+
// When left empty, no role should be assumed.
133+
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam:[0-9]{12}:role\/.*$`
134+
// +optional
135+
PrivateZoneIAMRole string `json:"privateZoneIAMRole"`
136+
}

‎config/v1/zz_generated.deepcopy.go‎

Lines changed: 38 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)