Skip to content

Commit ed025af

Browse files
patrickdillonpatrickdillon
committed
Add DNS support for AWS shared vpc with cross account private hosted zone.
1 parent 7ba3137 commit ed025af

7 files changed

Lines changed: 342 additions & 1 deletion

‎config/v1/0000_10_config-operator_01_dns.crd.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,47 @@ spec:
3939
baseDomain:
4040
description: "baseDomain is the base domain of the cluster. All managed DNS records will be sub-domains of this base. \n For example, given the base domain `openshift.example.com`, an API server DNS record may be created for `cluster-api.openshift.example.com`. \n Once set, this field cannot be changed."
4141
type: string
42+
platform:
43+
description: platform holds configuration specific to the underlying infrastructure provider for DNS. When omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time.
44+
type: object
45+
required:
46+
- type
47+
properties:
48+
aws:
49+
description: aws contains DNS configuration specific to the Amazon Web Services cloud provider.
50+
type: object
51+
properties:
52+
privateZoneIAMRole:
53+
description: privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing operations on the cluster's private hosted zone specified in the cluster DNS config. When left empty, no role should be assumed.
54+
type: string
55+
pattern: ^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$
56+
type:
57+
description: "type is the underlying infrastructure provider for the cluster. Allowed values: \"\", \"AWS\". \n Individual components may not support all platforms, and must handle unrecognized platforms with best-effort defaults."
58+
type: string
59+
enum:
60+
- ""
61+
- AWS
62+
- Azure
63+
- BareMetal
64+
- GCP
65+
- Libvirt
66+
- OpenStack
67+
- None
68+
- VSphere
69+
- oVirt
70+
- IBMCloud
71+
- KubeVirt
72+
- EquinixMetal
73+
- PowerVS
74+
- AlibabaCloud
75+
- Nutanix
76+
- External
77+
x-kubernetes-validations:
78+
- rule: self in ['','AWS']
79+
message: allowed values are '' and 'AWS'
80+
x-kubernetes-validations:
81+
- rule: 'has(self.type) && self.type == ''AWS'' ? has(self.aws) : !has(self.aws)'
82+
message: aws configuration is required when platform is AWS, and forbidden otherwise
4283
privateZone:
4384
description: "privateZone is the location where all the DNS records that are only available internally to the cluster exist. \n If this field is nil, no private records should be created. \n Once set, this field cannot be changed."
4485
type: object

‎config/v1/stable.dns.testsuite.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,94 @@ tests:
1212
apiVersion: config.openshift.io/v1
1313
kind: DNS
1414
spec: {}
15+
- name: Should be able to specify an AWS role ARN for a private hosted zone
16+
initial: |
17+
apiVersion: config.openshift.io/v1
18+
kind: DNS
19+
spec:
20+
platform:
21+
type: AWS
22+
aws:
23+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
24+
expected: |
25+
apiVersion: config.openshift.io/v1
26+
kind: DNS
27+
spec:
28+
platform:
29+
type: AWS
30+
aws:
31+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
32+
- name: Should not be able to specify unsupported platform
33+
initial: |
34+
apiVersion: config.openshift.io/v1
35+
kind: DNS
36+
spec:
37+
platform:
38+
type: Azure
39+
azure:
40+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
41+
expectedError: "Invalid value: \"string\": allowed values are '' and 'AWS'"
42+
- name: Should not be able to specify invalid AWS role ARN
43+
initial: |
44+
apiVersion: config.openshift.io/v1
45+
kind: DNS
46+
metadata:
47+
name: cluster
48+
spec:
49+
platform:
50+
type: AWS
51+
aws:
52+
privateZoneIAMRole: arn:aws:iam:bad:123456789012:role/foo
53+
expectedError: "DNS.config.openshift.io \"cluster\" is invalid: spec.platform.aws.privateZoneIAMRole: Invalid value: \"arn:aws:iam:bad:123456789012:role/foo\": spec.platform.aws.privateZoneIAMRole in body should match '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\\/.*$'"
54+
- name: Should not be able to specify different type and platform
55+
initial: |
56+
apiVersion: config.openshift.io/v1
57+
kind: DNS
58+
spec:
59+
platform:
60+
type: ""
61+
aws:
62+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
63+
expectedError: "Invalid value: \"object\": aws configuration is required when platform is AWS, and forbidden otherwise"
64+
onUpdate:
65+
- name: Can switch from empty (default), to AWS
66+
initial: |
67+
apiVersion: config.openshift.io/v1
68+
kind: DNS
69+
spec:
70+
platform:
71+
type: ""
72+
updated: |
73+
apiVersion: config.openshift.io/v1
74+
kind: DNS
75+
spec:
76+
platform:
77+
type: AWS
78+
aws:
79+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
80+
expected: |
81+
apiVersion: config.openshift.io/v1
82+
kind: DNS
83+
spec:
84+
platform:
85+
type: AWS
86+
aws:
87+
privateZoneIAMRole: arn:aws:iam::123456789012:role/foo
88+
- name: Upgrade case is valid
89+
initial: |
90+
apiVersion: config.openshift.io/v1
91+
kind: DNS
92+
spec: {} # No spec is required for a DNS
93+
updated: |
94+
apiVersion: config.openshift.io/v1
95+
kind: DNS
96+
spec:
97+
platform:
98+
type: ""
99+
expected: |
100+
apiVersion: config.openshift.io/v1
101+
kind: DNS
102+
spec:
103+
platform:
104+
type: ""
105+

‎config/v1/types_dns.go‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ type DNSSpec struct {
5050
//
5151
// +optional
5252
PrivateZone *DNSZone `json:"privateZone,omitempty"`
53+
// platform holds configuration specific to the underlying
54+
// infrastructure provider for DNS.
55+
// When omitted, this means the user has no opinion and the platform is left
56+
// to choose reasonable defaults. These defaults are subject to change over time.
57+
// +optional
58+
Platform DNSPlatformSpec `json:"platform,omitempty"`
5359
}
5460

5561
// DNSZone is used to define a DNS hosted zone.
@@ -90,3 +96,34 @@ type DNSList struct {
9096

9197
Items []DNS `json:"items"`
9298
}
99+
100+
// DNSPlatformSpec holds cloud-provider-specific configuration
101+
// for DNS administration.
102+
// +union
103+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'AWS' ? has(self.aws) : !has(self.aws)",message="aws configuration is required when platform is AWS, and forbidden otherwise"
104+
type DNSPlatformSpec struct {
105+
// type is the underlying infrastructure provider for the cluster.
106+
// Allowed values: "", "AWS".
107+
//
108+
// Individual components may not support all platforms,
109+
// and must handle unrecognized platforms with best-effort defaults.
110+
//
111+
// +unionDiscriminator
112+
// +kubebuilder:validation:Required
113+
// +kubebuilder:validation:XValidation:rule="self in ['','AWS']",message="allowed values are '' and 'AWS'"
114+
Type PlatformType `json:"type"`
115+
116+
// aws contains DNS configuration specific to the Amazon Web Services cloud provider.
117+
// +optional
118+
AWS *AWSDNSSpec `json:"aws"`
119+
}
120+
121+
// AWSDNSSpec contains DNS configuration specific to the Amazon Web Services cloud provider.
122+
type AWSDNSSpec struct {
123+
// privateZoneIAMRole contains the ARN of an IAM role that should be assumed when performing
124+
// operations on the cluster's private hosted zone specified in the cluster DNS config.
125+
// When left empty, no role should be assumed.
126+
// +kubebuilder:validation:Pattern:=`^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role\/.*$`
127+
// +optional
128+
PrivateZoneIAMRole string `json:"privateZoneIAMRole"`
129+
}

‎config/v1/zz_generated.deepcopy.go‎

Lines changed: 38 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)