OCPBUGS-60492: Skip Gateway Service DNS record creation on platforms with ClusterHostedDNS is configured #1269

sadasu · 2025-08-14T11:03:28Z

When in-cluster DNS/custom-DNS is configured on AWS and GCP, skip creating Gateway Service DNS record.

openshift-ci-robot · 2025-08-14T11:03:34Z

@sadasu: This pull request references Jira Issue OCPBUGS-60492, which is invalid:

expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

When in-cluster DNS/custom-DNS is configured on AWS and GCP, skip creating Gateway Service DNS record.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sadasu · 2025-08-14T11:04:43Z

/jira refresh

openshift-ci-robot · 2025-08-14T11:04:50Z

@sadasu: This pull request references Jira Issue OCPBUGS-60492, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.0) matches configured target version for branch (4.20.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @gpei

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Miciah · 2025-08-14T16:10:43Z

pkg/operator/controller/gateway-service-dns/controller.go

+	if !checkPlatformSupport(infraConfig) {
+		log.Info("infrastructure 'cluster' has unsupported configuration; reconciliation will be skipped")
+		return reconcile.Result{}, nil
+	}
+
 	domains := getGatewayHostnames(&gateway)
 	var errs []error
 	errs = append(errs, r.ensureDNSRecordsForGateway(ctx, &gateway, &service, domains.List(), infraConfig, dnsConfig)...)


It can be useful to create the DNSRecord CR, but with dnsManagementState: Unmanaged, to serve as a reference for what DNS record the cluster-admin is expected to create. So I would suggest still calling ensureDNSRecordsForGateway but changing it to to set dnsManagementState: Unmanaged when the platform is not supported. Does that make sense?

My reasoning for putting the check here vs ensureDNSRecordsForGateway was that this check would give the same outcome for each domain within ensureDNSRecordsForGateway.

I see that creating the DNSRecord CR could be useful, so updated implementation.

My reasoning for putting the check here vs ensureDNSRecordsForGateway was that this check would give the same outcome for each domain within ensureDNSRecordsForGateway.

If you're concerned about the performance impact, you can call checkClusterHostedDNS (previously checkPlatformSupport) in Reconcile and pass the Boolean result to ensureDNSRecordsForGateway.

Miciah · 2025-08-14T16:17:36Z

pkg/operator/controller/gateway-service-dns/controller.go

+// checkPlatformSupport return true if the platform supports gateway service dns.
+// Gateway service dns is currently not supported when in-cluster DNS is configured
+// for AWS or GCP platforms.
+func checkPlatformSupport(infraConfig *configv1.Infrastructure) bool {


Minor grammar and capitalization corrections:

Suggested change

// checkPlatformSupport return true if the platform supports gateway service dns.

// Gateway service dns is currently not supported when in-cluster DNS is configured

// for AWS or GCP platforms.

func checkPlatformSupport(infraConfig *configv1.Infrastructure) bool {

// checkPlatformSupport returns true if the platform supports gateway service DNS.

// Gateway service DNS is currently not supported when in-cluster DNS is configured

// for AWS or GCP platforms.

func checkPlatformSupport(infraConfig *configv1.Infrastructure) bool {

Also, I wonder whether the name might be misleading. We don't manage DNS at all on some platforms, but that isn't what this function checks; it only checks whether platforms on which we can manage the DNS records have some alternative custom DNS record management. Maybe a name like checkUsePlatformDefaultDNS? Or invert the Boolean value and condition, and rename the function to checkClusterHostedDNS?

Updated to invert the Boolean value and condition, and rename the function to checkClusterHostedDNS.

When ClusterHostedDNS is enabled, create Gateway Service DNS records with DNS Policy `Unmanaged`.

sadasu · 2025-08-15T04:22:49Z

/retest-required

candita · 2025-08-15T19:04:32Z

It would be good to investigate this CI failure. It seems related to me, being GCP and DNS.

=== NAME TestAll/parallel/TestInternalLoadBalancerGlobalAccessGCP
operator_test.go:1295: Expected conditions: map[Admitted:True Available:True DNSManaged:True DNSReady:True LoadBalancerManaged:True LoadBalancerReady:True]
Current conditions: map[Admitted:True Available:False DNSManaged:True DNSReady:False Degraded:True DeploymentAvailable:True DeploymentReplicasAllAvailable:True DeploymentReplicasMinAvailable:True DeploymentRollingOut:False EvaluationConditionsDetected:False LoadBalancerManaged:True LoadBalancerProgressing:False LoadBalancerReady:False Progressing:False Upgradeable:True]
...
"message": "One or more other status conditions indicate a degraded state: LoadBalancerReady=False (SyncLoadBalancerFailed: The service-controller component is reporting SyncLoadBalancerFailed events like: Error syncing load balancer: failed to ensure load balancer: googleapi: Error 400: Resource 'projects/XXXXXXXXXXXXXXXXXXXXXX/zones/us-central1-c/instances/ci-op-b4v9j4c3-76b3b-j7ls4-worker-c-sz59r' is expected to be in the subnetwork 'projects/XXXXXXXXXXXXXXXXXXXXXX/regions/us-central1/subnetworks/ci-op-b4v9j4c3-76b3b-j7ls4-master-subnet' but is in the subnetwork 'projects/XXXXXXXXXXXXXXXXXXXXXX/regions/us-central1/subnetworks/ci-op-b4v9j4c3-76b3b-j7ls4-worker-subnet'., wrongSubnetwork\nThe cloud-controller-manager logs may contain more details.)"
},

candita · 2025-08-15T22:23:14Z

pkg/operator/controller/gateway-service-dns/controller.go

+		if checkClusterHostedDNS(infraConfig) {
+			dnsPolicy = iov1.UnmanagedDNS
+		}


Can you please explain in a comment how this solves the problem of missing DNS name for Gateway objects?

custom-dns is enabled by the customer when they do not want OpenShift to use the cloud provider's default DNS. So, setting the dnsPolicy to iov1.UnmanagedDNS to cause the Gateway API controller to skip configuring the cloud's DNS.

In that case, can the tests provide whatever DNS is likely to be used instead, or at least something resembling DNS? We can't just assume it all works without testing it. Changing the name of this PR might help too.

In that case, can the tests provide whatever DNS is likely to be used instead, or at least something resembling DNS? We can't just assume it all works without testing it. Changing the name of this PR might help too.

The custom DNS CI workflows do that: install using on-cluster networking and then add user-provisioned DNS after the install. We will need to add those jobs to run in this repo.

patrickdillon · 2025-08-18T01:06:23Z

I suspect we do not need this PR, or to perform a specific conditional for custom DNS

Results are in, and it looks like the installer configuring the DNS zones to nil is not sufficient to resolve this issue.

So I think we do need a check in the ingress controller, but I would not make it specific to custom DNS, but rather based on the presence of the cloud PrivateZone and PublicZone in the DNS config.

sadasu · 2025-08-18T21:04:35Z

/hold

Miciah · 2025-08-18T22:20:04Z

/approve
/lgtm

I prefer if the Git commit message references the Jira issue and follows the Kubernetes commit message guidelines, but the changes look fine to me.

openshift-ci · 2025-08-18T22:20:25Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sadasu · 2025-08-18T23:10:53Z

/hold cancel

openshift-ci-robot · 2025-08-18T23:24:53Z

/retest-required

Remaining retests: 0 against base HEAD afb2160 and 2 for PR HEAD fb9ca0b in total

sadasu · 2025-08-19T00:08:00Z

/retest-required

openshift-ci-robot · 2025-08-19T02:43:01Z

/retest-required

Remaining retests: 0 against base HEAD afb2160 and 2 for PR HEAD fb9ca0b in total

openshift-ci-robot · 2025-08-19T13:13:54Z

/retest-required

Remaining retests: 0 against base HEAD afb2160 and 2 for PR HEAD fb9ca0b in total

openshift-ci-robot · 2025-08-19T19:18:11Z

/retest-required

Remaining retests: 0 against base HEAD 52a0048 and 1 for PR HEAD fb9ca0b in total

openshift-ci-robot · 2025-08-19T22:06:27Z

/retest-required

Remaining retests: 0 against base HEAD 52a0048 and 2 for PR HEAD fb9ca0b in total

openshift-ci-robot · 2025-08-20T03:58:42Z

/retest-required

Remaining retests: 0 against base HEAD 52a0048 and 2 for PR HEAD fb9ca0b in total

openshift-ci · 2025-08-20T06:16:37Z

@sadasu: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-operator	`fb9ca0b`	link	true	`/test e2e-gcp-operator`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

sadasu · 2025-08-20T11:29:36Z

/hold

We've identified that with custom-dns, when no Public and Private zones are specified in the DNS CR, no additional changes are required in the CIO for Gateway controller.
I think this PR can even be closed.

openshift-ci bot requested review from frobware and gcs278 August 14, 2025 11:04

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 14, 2025

openshift-ci bot requested a review from gpei August 14, 2025 11:04

Miciah reviewed Aug 14, 2025

View reviewed changes

Update Gateway Service DNS record when ClusterHostedDNS is enabled

fb9ca0b

When ClusterHostedDNS is enabled, create Gateway Service DNS records with DNS Policy `Unmanaged`.

sadasu force-pushed the gateway-service-with-custom-dns branch from 8d7424c to fb9ca0b Compare August 14, 2025 21:10

sadasu mentioned this pull request Aug 15, 2025

CORS-4174: Azure: Add Ingress LB IPs to Infra CR when in-cluster DNS is enabled #1256

Open

candita reviewed Aug 15, 2025

View reviewed changes

sadasu mentioned this pull request Aug 18, 2025

OCPBUGS-60492: Gateway service DNS: Add check for nil DNS Public and Private DNS zones #1270

Closed

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2025

alebedev87 mentioned this pull request Aug 18, 2025

OCPBUGS-59176: skip specific tests if DNSManaged is false openshift/origin#29985

Closed

openshift-ci bot assigned Miciah Aug 18, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 18, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 20, 2025

tthvo mentioned this pull request Aug 21, 2025

OCPBUGS-57364: custom-dns: Set PrivateZone and PublicZone to nil in the DNS manifest openshift/installer#9886

Merged

OCPBUGS-60492: Skip Gateway Service DNS record creation on platforms with ClusterHostedDNS is configured #1269

Are you sure you want to change the base?

OCPBUGS-60492: Skip Gateway Service DNS record creation on platforms with ClusterHostedDNS is configured #1269

Uh oh!

Conversation

sadasu commented Aug 14, 2025

Uh oh!

openshift-ci-robot commented Aug 14, 2025

Uh oh!

sadasu commented Aug 14, 2025

Uh oh!

openshift-ci-robot commented Aug 14, 2025

Uh oh!

Miciah Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

sadasu Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

Miciah Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

Miciah Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

sadasu Aug 14, 2025

Choose a reason for hiding this comment

Uh oh!

sadasu commented Aug 15, 2025

Uh oh!

candita commented Aug 15, 2025

Uh oh!

candita Aug 15, 2025

Choose a reason for hiding this comment

Uh oh!

sadasu Aug 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

candita Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

patrickdillon Aug 18, 2025

Choose a reason for hiding this comment

Uh oh!

patrickdillon commented Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sadasu commented Aug 18, 2025

Uh oh!

Miciah commented Aug 18, 2025

Uh oh!

openshift-ci bot commented Aug 18, 2025

Uh oh!

sadasu commented Aug 18, 2025

Uh oh!

openshift-ci-robot commented Aug 18, 2025

Uh oh!

sadasu commented Aug 19, 2025

Uh oh!

openshift-ci-robot commented Aug 19, 2025

Uh oh!

openshift-ci-robot commented Aug 19, 2025

Uh oh!

openshift-ci-robot commented Aug 19, 2025

Uh oh!

openshift-ci-robot commented Aug 19, 2025

Uh oh!

openshift-ci-robot commented Aug 20, 2025

Uh oh!

openshift-ci bot commented Aug 20, 2025

Uh oh!

sadasu commented Aug 20, 2025

Uh oh!

Uh oh!

sadasu Aug 16, 2025 •

edited

Loading

candita Aug 18, 2025 •

edited

Loading

patrickdillon commented Aug 18, 2025 •

edited

Loading