Skip to content

Commit 59c26c9

Browse files
sadasusadasu
committed
Add ability to disable creation of dns zone for unmanaged installs
Similar to managed installs, add ability to optionally create DNS zones for unmanged installs.
1 parent 2acf550 commit 59c26c9

File tree

7 files changed

+192
-5
lines changed

7 files changed

+192
-5
lines changed

‎api/v1beta1/azurecluster_webhook.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,13 @@ func (*AzureClusterWebhook) ValidateUpdate(_ context.Context, oldRaw, newObj run
147147
allErrs = append(allErrs, err)
148148
}
149149

150+
if err := webhookutils.ValidateImmutable(
151+
field.NewPath("spec", "networkSpec", "privateDNSZone"),
152+
old.Spec.NetworkSpec.PrivateDNSZone,
153+
c.Spec.NetworkSpec.PrivateDNSZone); err != nil {
154+
allErrs = append(allErrs, err)
155+
}
156+
150157
// Allow enabling azure bastion but avoid disabling it.
151158
if old.Spec.BastionSpec.AzureBastion != nil && !reflect.DeepEqual(old.Spec.BastionSpec.AzureBastion, c.Spec.BastionSpec.AzureBastion) {
152159
allErrs = append(allErrs,

‎api/v1beta1/azuremanagedcontrolplane_types.go

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,19 @@ const (
2525
// ManagedClusterFinalizer allows Reconcile to clean up Azure resources associated with the AzureManagedControlPlane before
2626
// removing it from the apiserver.
2727
ManagedClusterFinalizer = "azuremanagedcontrolplane.infrastructure.cluster.x-k8s.io"
28+
)
29+
30+
// PrivateDNSZoneMode determines the creation of Private DNS Zones in a private cluster.
31+
// When unset or set to the default value of PrivateDNSZoneModeSystem, Private DNS Zones are created.
32+
// When set to PrivateDNSZoneModeNone, Private DNS Zones are not created in a private cluster.
33+
type PrivateDNSZoneMode string
2834

29-
// PrivateDNSZoneModeSystem represents mode System for azuremanagedcontrolplane.
30-
PrivateDNSZoneModeSystem string = "System"
35+
const (
36+
// PrivateDNSZoneModeSystem represents mode System for Private DNS Zones.
37+
PrivateDNSZoneModeSystem PrivateDNSZoneMode = "System"
3138

32-
// PrivateDNSZoneModeNone represents mode None for azuremanagedcontrolplane.
33-
PrivateDNSZoneModeNone string = "None"
39+
// PrivateDNSZoneModeNone represents mode None for Private DNS Zones.
40+
PrivateDNSZoneModeNone PrivateDNSZoneMode = "None"
3441
)
3542

3643
// UpgradeChannel determines the type of upgrade channel for automatically upgrading the cluster.

‎api/v1beta1/types.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,12 @@ type NetworkSpec struct {
116116
// +optional
117117
AdditionalAPIServerLBPorts []LoadBalancerPort `json:"additionalAPIServerLBPorts,omitempty"`
118118

119+
// PrivateDNSZone enables private dns zone creation modes for a private cluster.
120+
// When unspecified, it defaults to PrivateDNSZoneModeSystem which creates a private DNS zone.
121+
// +kubebuilder:validation:Enum=System;None
122+
// +optional
123+
PrivateDNSZone *PrivateDNSZoneMode `json:"privateDNSZone,omitempty"`
124+
119125
NetworkClassSpec `json:",inline"`
120126
}
121127

‎api/v1beta1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎azure/scope/cluster.go

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,7 @@ func (s *ClusterScope) VNetSpec() azure.ASOResourceSpecGetter[*asonetworkv1api20
559559

560560
// PrivateDNSSpec returns the private dns zone spec.
561561
func (s *ClusterScope) PrivateDNSSpec() (zoneSpec azure.ResourceSpecGetter, linkSpec, recordSpec []azure.ResourceSpecGetter) {
562-
if s.IsAPIServerPrivate() {
562+
if s.IsAPIServerPrivate() && s.PrivateDNSZoneMode() != infrav1.PrivateDNSZoneModeNone {
563563
resourceGroup := s.ResourceGroup()
564564
if s.AzureCluster.Spec.NetworkSpec.PrivateDNSZoneResourceGroup != "" {
565565
resourceGroup = s.AzureCluster.Spec.NetworkSpec.PrivateDNSZoneResourceGroup
@@ -1251,3 +1251,13 @@ func (s *ClusterScope) getLastAppliedSecurityRules(nsgName string) map[string]in
12511251
}
12521252
return lastAppliedSecurityRules
12531253
}
1254+
1255+
// PrivateDNSZoneMode returns the current Private DNS Zone mode.
1256+
// When unconfigured, the method returns the default.
1257+
// Returned value is used to determine if the Private DNS Zone should be created.
1258+
func (s *ClusterScope) PrivateDNSZoneMode() infrav1.PrivateDNSZoneMode {
1259+
if s.AzureCluster.Spec.NetworkSpec.PrivateDNSZone == nil {
1260+
return infrav1.PrivateDNSZoneModeSystem
1261+
}
1262+
return *s.AzureCluster.Spec.NetworkSpec.PrivateDNSZone
1263+
}

‎azure/scope/cluster_test.go

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,58 @@ func TestAPIServerHost(t *testing.T) {
216216
},
217217
want: "apiserver.example.private",
218218
},
219+
{
220+
name: "private apiserver without private dns zone",
221+
azureCluster: infrav1.AzureCluster{
222+
Spec: infrav1.AzureClusterSpec{
223+
AzureClusterClassSpec: infrav1.AzureClusterClassSpec{
224+
SubscriptionID: fakeSubscriptionID,
225+
IdentityRef: &corev1.ObjectReference{
226+
Kind: infrav1.AzureClusterIdentityKind,
227+
},
228+
},
229+
ControlPlaneEnabled: true,
230+
NetworkSpec: infrav1.NetworkSpec{
231+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
232+
NetworkClassSpec: infrav1.NetworkClassSpec{
233+
PrivateDNSZoneName: "",
234+
},
235+
APIServerLB: &infrav1.LoadBalancerSpec{
236+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
237+
Type: infrav1.Internal,
238+
},
239+
},
240+
},
241+
},
242+
},
243+
want: "apiserver.my-cluster.capz.io",
244+
},
245+
{
246+
name: "private apiserver with private dns zone",
247+
azureCluster: infrav1.AzureCluster{
248+
Spec: infrav1.AzureClusterSpec{
249+
AzureClusterClassSpec: infrav1.AzureClusterClassSpec{
250+
SubscriptionID: fakeSubscriptionID,
251+
IdentityRef: &corev1.ObjectReference{
252+
Kind: infrav1.AzureClusterIdentityKind,
253+
},
254+
},
255+
ControlPlaneEnabled: true,
256+
NetworkSpec: infrav1.NetworkSpec{
257+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeSystem),
258+
NetworkClassSpec: infrav1.NetworkClassSpec{
259+
PrivateDNSZoneName: "",
260+
},
261+
APIServerLB: &infrav1.LoadBalancerSpec{
262+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
263+
Type: infrav1.Internal,
264+
},
265+
},
266+
},
267+
},
268+
},
269+
want: "apiserver.my-cluster.capz.io",
270+
},
219271
}
220272

221273
for _, tc := range tests {
@@ -4137,3 +4189,95 @@ func TestAPIServerLBName(t *testing.T) {
41374189
})
41384190
}
41394191
}
4192+
4193+
func TestPrivateDNSSpec(t *testing.T) {
4194+
tests := []struct {
4195+
name string
4196+
clusterName string
4197+
azureClusterNetworkSpec infrav1.NetworkSpec
4198+
expectPrivateDNSSpec bool
4199+
}{
4200+
{
4201+
name: "Default PrivateDNSZone (PrivateDNSZoneModeSystem)",
4202+
clusterName: "private-default",
4203+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4204+
NetworkClassSpec: infrav1.NetworkClassSpec{
4205+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4206+
},
4207+
APIServerLB: &infrav1.LoadBalancerSpec{
4208+
FrontendIPs: []infrav1.FrontendIP{
4209+
{
4210+
Name: "api-server-lb-internal-ip",
4211+
FrontendIPClass: infrav1.FrontendIPClass{
4212+
PrivateIPAddress: infrav1.DefaultInternalLBIPAddress,
4213+
},
4214+
},
4215+
},
4216+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4217+
Type: infrav1.Internal,
4218+
},
4219+
},
4220+
},
4221+
expectPrivateDNSSpec: true,
4222+
},
4223+
{
4224+
name: "PrivateDNSZone set to PrivateDNSZoneModeNone",
4225+
clusterName: "private-none",
4226+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4227+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
4228+
NetworkClassSpec: infrav1.NetworkClassSpec{
4229+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4230+
},
4231+
APIServerLB: &infrav1.LoadBalancerSpec{
4232+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4233+
Type: infrav1.Internal,
4234+
},
4235+
},
4236+
},
4237+
expectPrivateDNSSpec: false,
4238+
},
4239+
{
4240+
name: "Public LB",
4241+
clusterName: "public-none",
4242+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4243+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
4244+
NetworkClassSpec: infrav1.NetworkClassSpec{
4245+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4246+
},
4247+
APIServerLB: &infrav1.LoadBalancerSpec{
4248+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4249+
Type: infrav1.Public,
4250+
},
4251+
},
4252+
},
4253+
expectPrivateDNSSpec: false,
4254+
},
4255+
}
4256+
for _, tc := range tests {
4257+
t.Run(tc.name, func(t *testing.T) {
4258+
g := NewWithT(t)
4259+
4260+
cluster := &clusterv1.Cluster{
4261+
ObjectMeta: metav1.ObjectMeta{
4262+
Name: tc.clusterName,
4263+
Namespace: "default",
4264+
},
4265+
}
4266+
azureCluster := &infrav1.AzureCluster{
4267+
ObjectMeta: metav1.ObjectMeta{
4268+
Name: tc.clusterName,
4269+
},
4270+
Spec: infrav1.AzureClusterSpec{
4271+
NetworkSpec: tc.azureClusterNetworkSpec,
4272+
},
4273+
}
4274+
4275+
clusterScope := &ClusterScope{
4276+
Cluster: cluster,
4277+
AzureCluster: azureCluster,
4278+
}
4279+
zoneSpec, _, _ := clusterScope.PrivateDNSSpec()
4280+
g.Expect(zoneSpec != nil).Should(Equal(tc.expectPrivateDNSSpec))
4281+
})
4282+
}
4283+
}

‎config/crd/bases/infrastructure.cluster.x-k8s.io_azureclusters.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -926,6 +926,14 @@ spec:
926926
description: LBType defines an Azure load balancer Type.
927927
type: string
928928
type: object
929+
privateDNSZone:
930+
description: |-
931+
PrivateDNSZone enables private dns zone creation modes for a private cluster.
932+
When unspecified, it defaults to PrivateDNSZoneModeSystem which creates a private DNS zone.
933+
enum:
934+
- System
935+
- None
936+
type: string
929937
privateDNSZoneName:
930938
description: PrivateDNSZoneName defines the zone name for the
931939
Azure Private DNS.

0 commit comments

Comments
 (0)