-
Notifications
You must be signed in to change notification settings - Fork 192
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NE-1294: Add support for AWS shared VPC in another account #928
NE-1294: Add support for AWS shared VPC in another account #928
Conversation
@Miciah: This pull request references NE-1294 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Skipping CI for Draft Pull Request. |
682d60b
to
e336dd1
Compare
e336dd1
to
584d8fd
Compare
584d8fd
to
064d847
Compare
https://github.com/openshift/cluster-ingress-operator/compare/584d8fde704fda9b92ad8b91479833e3b47a5f30..064d8477b16e8551802a8fb3025bfe65eca5c8e2 adds a check for the "SharedVPC" feature gate. |
@Miciah: This pull request references NE-1294 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
064d847
to
c064b43
Compare
@Miciah: This pull request references NE-1294 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
https://github.com/openshift/cluster-ingress-operator/compare/064d8477b16e8551802a8fb3025bfe65eca5c8e2..c064b43a8dafbb43d5e240e3a875ddfa4d85e857 bumps the vendored openshift/api to get the actual |
I'm still keeping an eye on this, thanks for the responsiveness, updates look good to me |
c064b43
to
1bee175
Compare
https://github.com/openshift/cluster-ingress-operator/compare/c064b43a8dafbb43d5e240e3a875ddfa4d85e857..1bee17560eed0fd8ffdd9876f4b5a35344c2ee1b bumps to openshift/api@55be8ed, which makes |
1bee175
to
112d591
Compare
https://github.com/openshift/cluster-ingress-operator/compare/1bee17560eed0fd8ffdd9876f4b5a35344c2ee1b..112d591d6c8dcbc36a8f98993cc9a9387acb071b rebases to get #936 and replaces the openshift/api@55be8ed vendor bump with the actual merge commit, openshift/api@83abb00. |
/test ? |
@romfreiman: The following commands are available to trigger required jobs:
The following commands are available to trigger optional jobs:
Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/test e2e-aws-ovn-upgrade |
/test e2e-hypershift |
Unrelated hypershift issues:
|
/label qe-approved With Installer QE's helping, we got a cluster and tested the PR, it looks good.
note: the test results is from a Passthrough mode cluster. We're still seeing some issues on STS mode cluster but looks like configuration issue and will not block this PR to be merged. |
/jira-refresh |
Bump to github.com/openshift/api@5c5196d9f4af26e7a404d5f101f7305036cf19a7 to get the new "PrivateHostedZoneAWS" feature gate and the DNS.spec.platform.aws.privateZoneIAMRole API field to allow configuring a private hosted zone in a shared VPC. * go.mod: Bump openshift/api. * go.sum: * vendor/*: Regenerate.
1eecdd9
to
dbf1626
Compare
Rebased for #906. |
Add support for configuring DNS records in AWS Route 53 using a separate account for the private hosted zone. This commit resolves NE-1294. https://issues.redhat.com/browse/NE-1294 * manifests/00-ingress-credentials-request.yaml: Add "sts:AssumeRole" to the CredentialsRequest for AWS. * pkg/manifests/bindata.go: Regenerate. * pkg/dns/aws/dns.go (Config): Add a RoleARN field. (NewProvider): If config.RoleARN is set, use it to configure the AWS client using the specified role. * pkg/dns/split/dns.go: New file. Define a DNS provider implementation that wraps two other DNS providers, using one of them to publish records to the public zone and the other to publish records to the private zone. (Provider): New type. Store the private and public DNS providers, as well as the private zone so that the Ensure, Delete, and Replace methods can use it to determine whether they are publishing to the public zone or to the private zone. (NewProvider): New function. Return a split DNS provider. (Ensure, Delete, Replace): New methods. Implement the dns.Provider interface by calling the respective methods on the wrapped private and public DNS providers. * pkg/dns/split/dns_test.go (TestSplitDNSProvider): Verify that the split DNS provider correctly dispatches to the private or public DNS provider as appropriate, using fakeProvider. (fakeProvider): New type. Define a fake named DNS provider that records its name when invoked. (Ensure, Delete, Replace): New methods for fakeProvider to record invocations and implement the dns.Provider interface. (newFakeProvider): New function. Return a fake provider. * pkg/operator/controller/dns/controller.go (Config): Add a "PrivateHostedZoneAWSEnabled" field to indicate whether the "PrivateHostedZoneAWS" feature gate is enabled. (createDNSProvider): Use the new split DNS provider and the AWS DNS provider's new RoleARN configuration option to configure separate DNS providers for public and private zones when a role ARN for the private zone is specified in the cluster infrastructure config if the "PrivateHostedZoneAWS" feature gate is enabled. * pkg/operator/operator.go (New): Check the "PrivateHostedZoneAWS" feature gate and specify it in the DNS controller config.
dbf1626
to
7251aaa
Compare
@Miciah: This pull request references NE-1294 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
https://github.com/openshift/cluster-ingress-operator/compare/dbf16265f1718bc51476d36e75e709bdd8991b00..7251aaa9a30f3759c2731d061207d2f63cd945de adds |
|
|
|
e2e-aws-operator failed on e2e-gcp-operator failed because e2e-hypershift failed because |
Regarding the e2e-hypershift failure, search.ci reports rather a lot of failures for
|
e2e-hypershift failed on |
/test e2e-hypershift |
@Miciah: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
/label jira/valid-bug |
Add support for configuring DNS records in AWS Route 53 using a separate account for the private hosted zone.
manifests/00-ingress-credentials-request.yaml
: Add "sts:AssumeRole" to the CredentialsRequest for AWS.pkg/manifests/bindata.go
: Regenerate.pkg/dns/aws/dns.go
(Config
): Add aRoleARN
field.(
NewProvider
): Ifconfig.RoleARN
is set, use it to configure the AWS client using the specified role.pkg/dns/split/dns.go
: New file. Define a DNS provider implementation that wraps two other DNS providers, using one of them to publish records to the public zone and the other to publish records to the private zone.(
Provider
): New type. Store the private and public DNS providers, as well as the private zone so that theEnsure
,Delete
, andReplace
methods can use it to determine whether they are publishing to the public zone or to the private zone.(
NewProvider
): New function. Return a split DNS provider.(
Ensure
,Delete
,Replace
): New methods. Implement thedns.Provider
interface by calling the respective methods on the wrapped private and public DNS providers.pkg/dns/split/dns_test.go
(TestSplitDNSProvider
): Verify that the split DNS provider correctly dispatches to the private or public DNS provider as appropriate, usingfakeProvider
.(
fakeProvider
): New type. Define a fake named DNS provider that records its name when invoked.(
Ensure
,Delete
,Replace
): New methods forfakeProvider
to record invocations and implement thedns.Provider
interface.(
newFakeProvider
): New function. Return a fake provider.pkg/operator/controller/dns/controller.go
(Config
): Add aPrivateHostedZoneAWSEnabled
field to indicate whether the "PrivateHostedZoneAWS" feature gate is enabled.(
createDNSProvider
): Use the new split DNS provider and the AWS DNS provider's newRoleARN
configuration option to configure separate DNS providers for public and private zones when a role ARN for the private zone is specified in the cluster infrastructure config if the "PrivateHostedZoneAWS" feature gate is enabled.pkg/operator/operator.go
(New
): Check the "PrivateHostedZoneAWS" feature gate and specify it in the DNS controller config.This PR is a draft because the
Infrastructure.status.platformStatus.aws.privateHostedZoneRole
API field doesn't exist yet and this is completely untested.