Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

✨ Add support for private dns zones #1033

Merged
merged 1 commit into from
Nov 18, 2020
Merged

✨ Add support for private dns zones #1033

merged 1 commit into from
Nov 18, 2020

Conversation

CecileRobertMichon
Copy link
Contributor

@CecileRobertMichon CecileRobertMichon commented Nov 12, 2020 •
edited by nader-ziada
Loading

What type of PR is this?
/kind feature

What this PR does / why we need it: This PR adds private dns support for private clusters. When a cluster with an internal api server LB is created, capz will create a private dns zone with it and link it to the cluster's vnet. The internal LB IP is then added to the dns zone as a record with hostname apiserver. This allows reaching the API Server from within the vnet with FQDN apiserver.$CLUSTER_NAME.capz.io. It also fixes the hairpin routing issue on all control plane VMs by adding a hosts entry so control planes resolve apiserver as localhost.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1016

Special notes for your reviewer:

Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

TODOs:

  • squashed commits
  • includes documentation
  • adds unit tests

Release note:

Add support for private dns zones

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/feature Categorizes issue or PR as related to a new feature. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Nov 12, 2020
@k8s-ci-robot k8s-ci-robot added area/provider/azure Issues or PRs related to azure provider sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. labels Nov 12, 2020
@CecileRobertMichon CecileRobertMichon changed the title [WIP] ✨ Add support for private dns zones ✨ Add support for private dns zones Nov 13, 2020
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 13, 2020
devigned
devigned reviewed Nov 13, 2020
View reviewed changes
Copy link
Contributor

@devigned devigned left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Had a couple questions. Looks great!

api/v1alpha3/types.go Outdated Show resolved Hide resolved
cloud/types.go Outdated Show resolved Hide resolved
templates/test/cluster-template-prow-private.yaml Show resolved Hide resolved
@CecileRobertMichon CecileRobertMichon force-pushed the private-dns branch 2 times, most recently from b481e14 to c9174dd Compare November 13, 2020 19:24
nader-ziada
nader-ziada reviewed Nov 16, 2020
View reviewed changes
Copy link
Contributor

@nader-ziada nader-ziada left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all good except for one small kind of nit

cloud/services/privatedns/privatedns.go Outdated Show resolved Hide resolved
@nader-ziada
Copy link
Contributor

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 16, 2020
@voor
Copy link
Member

voor commented Nov 17, 2020

Does Azure Private DNS allow setting a recursive resolver? My very limited experience with it seemed to cause DNS issues, but there's a good chance it wasn't configured properly.

devigned
devigned suggested changes Nov 17, 2020
View reviewed changes
Copy link
Contributor

@devigned devigned left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couple requested changes. Per the sorted imports, I'll open a PR with a linter rule to enforce.

api/v1alpha3/types.go Outdated Show resolved Hide resolved
cloud/services/privatedns/privatedns_test.go Show resolved Hide resolved
@devigned
Copy link
Contributor

@jadarsie what do you think of private DNS entries with regard to Azure Stack?

@CecileRobertMichon
Copy link
Contributor Author

Does Azure Private DNS allow setting a recursive resolver? My very limited experience with it seemed to cause DNS issues, but there's a good chance it wasn't configured properly.

@voor it does not, but Azure VMs are already configured to have "a recursive DNS service that is provided separately as part of Azure's infrastructure" (source https://docs.microsoft.com/en-us/azure/dns/dns-domain-delegation#resolution-and-delegation). What kind of issues did you run into? I have not observed any issues while testing this so far.

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 17, 2020
devigned
devigned approved these changes Nov 17, 2020
View reviewed changes
Copy link
Contributor

@devigned devigned left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 17, 2020
@devigned
Copy link
Contributor

/retest

@CecileRobertMichon
Copy link
Contributor Author

(testing something unrelated)

/test pull-cluster-api-provider-azure-capi-e2e

@CecileRobertMichon
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-capi-e2e

@CecileRobertMichon
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-capi-e2e

fixed the cred issue in #1043

@CecileRobertMichon
Copy link
Contributor Author

/retest

@nader-ziada
Copy link
Contributor

/lgtm
/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nader-ziada

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 18, 2020
@CecileRobertMichon
Copy link
Contributor Author

/retest

@CecileRobertMichon
Copy link
Contributor Author

different flake :(

/retest

@nader-ziada
Copy link
Contributor

/test pull-cluster-api-provider-azure-e2e

@k8s-ci-robot k8s-ci-robot merged commit 33345d2 into kubernetes-sigs:master Nov 18, 2020
@k8s-ci-robot k8s-ci-robot added this to the v0.4.10 milestone Nov 18, 2020
@CecileRobertMichon CecileRobertMichon deleted the private-dns branch March 19, 2021 17:55
@dlipovetsky
Copy link
Contributor

It also fixes the hairpin routing issue on all control plane VMs by adding a hosts entry so control planes resolve apiserver as localhost.

For reference, the page linked in the description doesn't include the relevant issue; I think it was moved here: https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshoot-backend-traffic#cause-4-accessing-the-internal-load-balancer-frontend-from-the-participating-load-balancer-backend-pool-vm

@dlipovetsky dlipovetsky mentioned this pull request Jan 24, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nader-ziada nader-ziada nader-ziada left review comments

@devigned devigned devigned approved these changes

@justaugustus justaugustus Awaiting requested review from justaugustus

Assignees

@devigned devigned

@nader-ziada nader-ziada

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/provider/azure Issues or PRs related to azure provider cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
v0.4.10
Development

Successfully merging this pull request may close these issues.

Implement Azure private dns for private clusters
6 participants
@CecileRobertMichon @nader-ziada @voor @devigned @k8s-ci-robot @dlipovetsky