Skip to content

Commit b17b877

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #5666 from sadasu/unmanaged-privateDNSZoneMode
Add ability to disable creation of dns zone for unmanaged installs
2 parents 72b27bb + 59c26c9 commit b17b877

File tree

7 files changed

+192
-5
lines changed

7 files changed

+192
-5
lines changed

‎api/v1beta1/azurecluster_webhook.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,13 @@ func (*AzureClusterWebhook) ValidateUpdate(_ context.Context, oldRaw, newObj run
147147
allErrs = append(allErrs, err)
148148
}
149149

150+
if err := webhookutils.ValidateImmutable(
151+
field.NewPath("spec", "networkSpec", "privateDNSZone"),
152+
old.Spec.NetworkSpec.PrivateDNSZone,
153+
c.Spec.NetworkSpec.PrivateDNSZone); err != nil {
154+
allErrs = append(allErrs, err)
155+
}
156+
150157
// Allow enabling azure bastion but avoid disabling it.
151158
if old.Spec.BastionSpec.AzureBastion != nil && !reflect.DeepEqual(old.Spec.BastionSpec.AzureBastion, c.Spec.BastionSpec.AzureBastion) {
152159
allErrs = append(allErrs,

‎api/v1beta1/azuremanagedcontrolplane_types.go

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,19 @@ const (
2525
// ManagedClusterFinalizer allows Reconcile to clean up Azure resources associated with the AzureManagedControlPlane before
2626
// removing it from the apiserver.
2727
ManagedClusterFinalizer = "azuremanagedcontrolplane.infrastructure.cluster.x-k8s.io"
28+
)
29+
30+
// PrivateDNSZoneMode determines the creation of Private DNS Zones in a private cluster.
31+
// When unset or set to the default value of PrivateDNSZoneModeSystem, Private DNS Zones are created.
32+
// When set to PrivateDNSZoneModeNone, Private DNS Zones are not created in a private cluster.
33+
type PrivateDNSZoneMode string
2834

29-
// PrivateDNSZoneModeSystem represents mode System for azuremanagedcontrolplane.
30-
PrivateDNSZoneModeSystem string = "System"
35+
const (
36+
// PrivateDNSZoneModeSystem represents mode System for Private DNS Zones.
37+
PrivateDNSZoneModeSystem PrivateDNSZoneMode = "System"
3138

32-
// PrivateDNSZoneModeNone represents mode None for azuremanagedcontrolplane.
33-
PrivateDNSZoneModeNone string = "None"
39+
// PrivateDNSZoneModeNone represents mode None for Private DNS Zones.
40+
PrivateDNSZoneModeNone PrivateDNSZoneMode = "None"
3441
)
3542

3643
// UpgradeChannel determines the type of upgrade channel for automatically upgrading the cluster.

‎api/v1beta1/types.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,12 @@ type NetworkSpec struct {
116116
// +optional
117117
AdditionalAPIServerLBPorts []LoadBalancerPort `json:"additionalAPIServerLBPorts,omitempty"`
118118

119+
// PrivateDNSZone enables private dns zone creation modes for a private cluster.
120+
// When unspecified, it defaults to PrivateDNSZoneModeSystem which creates a private DNS zone.
121+
// +kubebuilder:validation:Enum=System;None
122+
// +optional
123+
PrivateDNSZone *PrivateDNSZoneMode `json:"privateDNSZone,omitempty"`
124+
119125
NetworkClassSpec `json:",inline"`
120126
}
121127

‎api/v1beta1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎azure/scope/cluster.go

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,7 @@ func (s *ClusterScope) VNetSpec() azure.ASOResourceSpecGetter[*asonetworkv1api20
559559

560560
// PrivateDNSSpec returns the private dns zone spec.
561561
func (s *ClusterScope) PrivateDNSSpec() (zoneSpec azure.ResourceSpecGetter, linkSpec, recordSpec []azure.ResourceSpecGetter) {
562-
if s.IsAPIServerPrivate() {
562+
if s.IsAPIServerPrivate() && s.PrivateDNSZoneMode() != infrav1.PrivateDNSZoneModeNone {
563563
resourceGroup := s.ResourceGroup()
564564
if s.AzureCluster.Spec.NetworkSpec.PrivateDNSZoneResourceGroup != "" {
565565
resourceGroup = s.AzureCluster.Spec.NetworkSpec.PrivateDNSZoneResourceGroup
@@ -1251,3 +1251,13 @@ func (s *ClusterScope) getLastAppliedSecurityRules(nsgName string) map[string]in
12511251
}
12521252
return lastAppliedSecurityRules
12531253
}
1254+
1255+
// PrivateDNSZoneMode returns the current Private DNS Zone mode.
1256+
// When unconfigured, the method returns the default.
1257+
// Returned value is used to determine if the Private DNS Zone should be created.
1258+
func (s *ClusterScope) PrivateDNSZoneMode() infrav1.PrivateDNSZoneMode {
1259+
if s.AzureCluster.Spec.NetworkSpec.PrivateDNSZone == nil {
1260+
return infrav1.PrivateDNSZoneModeSystem
1261+
}
1262+
return *s.AzureCluster.Spec.NetworkSpec.PrivateDNSZone
1263+
}

‎azure/scope/cluster_test.go

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,58 @@ func TestAPIServerHost(t *testing.T) {
216216
},
217217
want: "apiserver.example.private",
218218
},
219+
{
220+
name: "private apiserver without private dns zone",
221+
azureCluster: infrav1.AzureCluster{
222+
Spec: infrav1.AzureClusterSpec{
223+
AzureClusterClassSpec: infrav1.AzureClusterClassSpec{
224+
SubscriptionID: fakeSubscriptionID,
225+
IdentityRef: &corev1.ObjectReference{
226+
Kind: infrav1.AzureClusterIdentityKind,
227+
},
228+
},
229+
ControlPlaneEnabled: true,
230+
NetworkSpec: infrav1.NetworkSpec{
231+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
232+
NetworkClassSpec: infrav1.NetworkClassSpec{
233+
PrivateDNSZoneName: "",
234+
},
235+
APIServerLB: &infrav1.LoadBalancerSpec{
236+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
237+
Type: infrav1.Internal,
238+
},
239+
},
240+
},
241+
},
242+
},
243+
want: "apiserver.my-cluster.capz.io",
244+
},
245+
{
246+
name: "private apiserver with private dns zone",
247+
azureCluster: infrav1.AzureCluster{
248+
Spec: infrav1.AzureClusterSpec{
249+
AzureClusterClassSpec: infrav1.AzureClusterClassSpec{
250+
SubscriptionID: fakeSubscriptionID,
251+
IdentityRef: &corev1.ObjectReference{
252+
Kind: infrav1.AzureClusterIdentityKind,
253+
},
254+
},
255+
ControlPlaneEnabled: true,
256+
NetworkSpec: infrav1.NetworkSpec{
257+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeSystem),
258+
NetworkClassSpec: infrav1.NetworkClassSpec{
259+
PrivateDNSZoneName: "",
260+
},
261+
APIServerLB: &infrav1.LoadBalancerSpec{
262+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
263+
Type: infrav1.Internal,
264+
},
265+
},
266+
},
267+
},
268+
},
269+
want: "apiserver.my-cluster.capz.io",
270+
},
219271
}
220272

221273
for _, tc := range tests {
@@ -4137,3 +4189,95 @@ func TestAPIServerLBName(t *testing.T) {
41374189
})
41384190
}
41394191
}
4192+
4193+
func TestPrivateDNSSpec(t *testing.T) {
4194+
tests := []struct {
4195+
name string
4196+
clusterName string
4197+
azureClusterNetworkSpec infrav1.NetworkSpec
4198+
expectPrivateDNSSpec bool
4199+
}{
4200+
{
4201+
name: "Default PrivateDNSZone (PrivateDNSZoneModeSystem)",
4202+
clusterName: "private-default",
4203+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4204+
NetworkClassSpec: infrav1.NetworkClassSpec{
4205+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4206+
},
4207+
APIServerLB: &infrav1.LoadBalancerSpec{
4208+
FrontendIPs: []infrav1.FrontendIP{
4209+
{
4210+
Name: "api-server-lb-internal-ip",
4211+
FrontendIPClass: infrav1.FrontendIPClass{
4212+
PrivateIPAddress: infrav1.DefaultInternalLBIPAddress,
4213+
},
4214+
},
4215+
},
4216+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4217+
Type: infrav1.Internal,
4218+
},
4219+
},
4220+
},
4221+
expectPrivateDNSSpec: true,
4222+
},
4223+
{
4224+
name: "PrivateDNSZone set to PrivateDNSZoneModeNone",
4225+
clusterName: "private-none",
4226+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4227+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
4228+
NetworkClassSpec: infrav1.NetworkClassSpec{
4229+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4230+
},
4231+
APIServerLB: &infrav1.LoadBalancerSpec{
4232+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4233+
Type: infrav1.Internal,
4234+
},
4235+
},
4236+
},
4237+
expectPrivateDNSSpec: false,
4238+
},
4239+
{
4240+
name: "Public LB",
4241+
clusterName: "public-none",
4242+
azureClusterNetworkSpec: infrav1.NetworkSpec{
4243+
PrivateDNSZone: ptr.To(infrav1.PrivateDNSZoneModeNone),
4244+
NetworkClassSpec: infrav1.NetworkClassSpec{
4245+
PrivateDNSZoneName: "fake-privateDNSZoneName",
4246+
},
4247+
APIServerLB: &infrav1.LoadBalancerSpec{
4248+
LoadBalancerClassSpec: infrav1.LoadBalancerClassSpec{
4249+
Type: infrav1.Public,
4250+
},
4251+
},
4252+
},
4253+
expectPrivateDNSSpec: false,
4254+
},
4255+
}
4256+
for _, tc := range tests {
4257+
t.Run(tc.name, func(t *testing.T) {
4258+
g := NewWithT(t)
4259+
4260+
cluster := &clusterv1.Cluster{
4261+
ObjectMeta: metav1.ObjectMeta{
4262+
Name: tc.clusterName,
4263+
Namespace: "default",
4264+
},
4265+
}
4266+
azureCluster := &infrav1.AzureCluster{
4267+
ObjectMeta: metav1.ObjectMeta{
4268+
Name: tc.clusterName,
4269+
},
4270+
Spec: infrav1.AzureClusterSpec{
4271+
NetworkSpec: tc.azureClusterNetworkSpec,
4272+
},
4273+
}
4274+
4275+
clusterScope := &ClusterScope{
4276+
Cluster: cluster,
4277+
AzureCluster: azureCluster,
4278+
}
4279+
zoneSpec, _, _ := clusterScope.PrivateDNSSpec()
4280+
g.Expect(zoneSpec != nil).Should(Equal(tc.expectPrivateDNSSpec))
4281+
})
4282+
}
4283+
}

‎config/crd/bases/infrastructure.cluster.x-k8s.io_azureclusters.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -926,6 +926,14 @@ spec:
926926
description: LBType defines an Azure load balancer Type.
927927
type: string
928928
type: object
929+
privateDNSZone:
930+
description: |-
931+
PrivateDNSZone enables private dns zone creation modes for a private cluster.
932+
When unspecified, it defaults to PrivateDNSZoneModeSystem which creates a private DNS zone.
933+
enum:
934+
- System
935+
- None
936+
type: string
929937
privateDNSZoneName:
930938
description: PrivateDNSZoneName defines the zone name for the
931939
Azure Private DNS.

0 commit comments

Comments
 (0)