Skip to content

Commit

Permalink
add doc for configuring dns provider
Browse files Browse the repository at this point in the history
  • Loading branch information
maleck13 committed Sep 4, 2023
1 parent 2db61d7 commit 39a8888
Show file tree
Hide file tree
Showing 6 changed files with 94 additions and 29 deletions.
3 changes: 0 additions & 3 deletions config/crd/bases/kuadrant.io_managedzones.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -65,12 +65,9 @@ spec:
type: string
namespace:
type: string
type:
type: string
required:
- name
- namespace
- type
type: object
domainName:
description: Domain name of this ManagedZone
Expand Down
26 changes: 25 additions & 1 deletion docs/dns-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -484,7 +484,7 @@ lrnse3.lb-2903yb.echo.apps.hcpapps.net.
#### Configuring Cluster Geo Locations

The `defaultGeo` as described above puts all clusters into the same geo group, but for geo to be useful we need to mark our clusters as being in different locations.
We can do this though by adding `geo-code` attributes on the ManagedCluster to show which county each cluster is in. The values that can be used are determined by the dns provider, in the case of Route53 any two digit ISO3166 alpha-2 country code (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2).
We can do this though by adding `geo-code` attributes on the ManagedCluster to show which county each cluster is in. The values that can be used are determined by the dns provider (See Below).

Apply `geo-code` labels to each of our managed cluster resources:
```bash
Expand Down Expand Up @@ -562,3 +562,27 @@ kubectl get dnsrecord echo.apps.hcpapps.net -n multi-cluster-gateways -o yaml |

In the above scenario any requests made in Spain will be returned the IP address of `kind-mgc-workload-2` and requests made from anywhere else in the world will be returned the IP address of `kind-mgc-workload-1`.
Weighting of records is still enforced between clusters in the same geo group, in the case above however they are having no effect since there is only one cluster in each group.

:exclamation:
If a unsupported value is given to a provider, DNS records will **not** be created. Please choose carefully. For more information of what location is right for your needs please read said providers documentation.

##### Locations supported per DNS provider

| Supported | AWS | GCP |
|---------------|-----|-----|
| Continents | :white_check_mark: | :x: |
| Country codes | :white_check_mark: | :x: |
| States | :white_check_mark: | :x: |
| Regions | :x: | :white_check_mark: |

##### Continents and country codes supported by AWS Route 53

:**Note:** :exclamation: For more information please the official AWS documentation

To see all regions supported by AWS Route 53 please see the official (documtation)[https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values-geo.html]

##### Regions supported by GCP CLoud DNS

To see all regions supported by GCP Cloud DNS please see the offical (documtation)[https://cloud.google.com/compute/docs/regions-zones]


62 changes: 62 additions & 0 deletions docs/how-to/dns-provider.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
# Configuring a DNS Provider

In order to be able to interact with supported DNS providers, Kuadrant needs a credential that it can use. This credential is leveraged by the multi-cluster gateway controller in order to create and manage DNS records within zones used by the listeners defined in your gateways.


## Supported Providers

Kuadrant Supports the following DNS providers currently

- AWS route 53
- Google DNS



## Configuring an AWS Route 53 provider

Kuadant expects a secret with a credential. Below is an example for route 53

```
apiVersion: v1
data:
AWS_ACCESS_KEY_ID: XXXXX
AWS_REGION: XXXXX
AWS_SECRET_ACCESS_KEY: XXXXX
kind: Secret
metadata:
name: aws-credentials
namespace: multicluster-gateway-controller-system
type: kuadrant.io/aws
```

## IAM permissions required
We have tested using the available policy `AmazonRoute53FullAccess` however it should also be possible to restrict the credential down to a particular zone. More info can be found in the AWS docs
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-managing-permissions.html

## Configuring a Google DNS provider

```
apiVersion: v1
data:
GOOGLE: {"client_id": "00000000-00000000000000.apps.googleusercontent.com","client_secret": "d-FL95Q00000000000000","refresh_token": "00000aaaaa00000000-AAAAAAAAAAAAKFGJFJDFKDK","type": "authorized_user"}
PROJECT_ID: "my-project"
kind: Secret
metadata:
name: aws-credentials
namespace: multicluster-gateway-controller-system
type: kuadrant.io/aws
```


### Access permissions required
https://cloud.google.com/dns/docs/access-control#dns.admin


Now that we have the credential created we have a DNSProvdier ready to go.

## Using a credential

Once a secret like the one shown above is created, in order for it to be used, it needs to be associated with a `ManagedZone`.

See [ManagedZone](managedZone.md)

7 changes: 7 additions & 0 deletions docs/how-to/managedZone.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,15 @@ metadata:
name: testmz.hcpapps.net
spec:
domainName: testmz.hcapps.net
secretRef:
Name: my-credential
NameSpace: ns
```

### Secret Ref

This is a reference to a secret that contains a credential for accessing the DNS Provider. See [dns-provider](./dns-provider.md) for more details.

### Optional fields
The following fields are optional:
#### ID
Expand Down
24 changes: 0 additions & 24 deletions docs/how-to/providers/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,31 +7,7 @@ The following document tells you everything you need to know about the DNS Provi

In the current iteration of the multi-cluster gateway controller we support both **AWS (Amazon web services) Route 53** and **GCP (Google cloud provider) cloud DNS**.

### Geolocation

Geolocation is a feature available in both DNS providers we support. A location is needed for both DNS Providers, please see below for the supported location for the provider you require.

:exclamation:
If a unsupported value is given to a provider, DNS records will **not** be created. Please choose carefully. For more information of what location is right for your needs please read said providers documentation.

## Locations supported per DNS provider

| Supported | AWS | GCP |
|---------------|-----|-----|
| Continents | :white_check_mark: | :x: |
| Country codes | :white_check_mark: | :x: |
| States | :white_check_mark: | :x: |
| Regions | :x: | :white_check_mark: |

## Continents and country codes supported by AWS Route 53

:**Note:** :exclamation: For more information please the official AWS documentation

To see all regions supported by AWS Route 53 please see the offical (documtation)[https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values-geo.html]

## Regions supported by GCP CLoud DNS

To see all regions supported by GCP Cloud DNS please see the offical (documtation)[https://cloud.google.com/compute/docs/regions-zones]
## Setting up DNS provider

### AWS Route 53
Expand Down
1 change: 0 additions & 1 deletion pkg/apis/v1alpha1/managedzone_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ type SecretRef struct {
//+required
Namespace string `json:"namespace"`
Name string `json:"name"`
Type string `json:"type"`
}

// ManagedZoneStatus defines the observed state of a Zone
Expand Down

0 comments on commit 39a8888

Please sign in to comment.