OCPBUGS-31521: Don't allow DNS records for gateway to be created if they clash with any existing ingress controller. #1145

rfredette · 2024-09-12T20:40:40Z

If a gateway attempts to create a listener for a domain that's already served by an ingress controller, don't create a DNSRecord for that domain, and log an error.

In the future, some more visible method of error reporting should be added, such as an alert or a status condition on a relevant object, but that is intentionally left for a future change.

openshift-ci-robot · 2024-09-12T20:40:45Z

@rfredette: This pull request references Jira Issue OCPBUGS-31521, which is invalid:

expected the bug to target the "4.18.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

If a gateway attempts to create a listener for a domain that's already served by an ingress controller, don't create a DNSRecord for that domain, and log an error.

In the future, some more visible method of error reporting should be added, such as an alert or a status condition on a relevant object, but that is intentionally left for a future change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rfredette · 2024-09-12T20:41:07Z

/jira refresh

openshift-ci-robot · 2024-09-12T20:41:13Z

@rfredette: This pull request references Jira Issue OCPBUGS-31521, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.18.0) matches configured target version for branch (4.18.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rfredette · 2024-09-12T21:07:02Z

Hit some 500 internal server errors during initial setup on several tests
/retest

rfredette · 2024-09-13T20:53:03Z

/retest

candita · 2024-09-18T17:06:29Z

/assign

candita · 2024-09-18T17:09:18Z

Lots of disruption failures.
/retest

pkg/operator/controller/gateway-service-dns/controller.go

pkg/operator/controller/gateway-service-dns/controller_test.go

openshift-ci · 2024-10-17T21:05:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from candita. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…ting ingress controllers.

rfredette · 2024-10-21T15:32:47Z

Test failures include underlying cluster instability
/retest

pkg/operator/controller/gateway-service-dns/controller.go

candita · 2024-10-29T01:15:06Z

pkg/operator/controller/gateway-service-dns/controller_test.go

+					l("stage-https", "*.stage.apps.example.com", 443),
+					// apps.example.com looks like it'll clash with the default ic below, but the ic creates a record
+					// for *.apps.example.com, which doesn't actually clash with apps.example.com
+					l("apps-https", "apps.example.com", 443),


This should clash though, because the DNSRecord for the listener is created as a wildcard and thus will be prefixed with *. too. This has to be prevented because if the listener's DNSRecord gets deleted then the IC's DNSRecord is too and the component routes begin to fail.

I've since learned that tests that don't use the right baseDomain for hostnames won't create DNSrecords at all. You'll need to use a baseDomain that is part of the zones for DNS, and "example.com" is not.

candita · 2024-10-29T01:22:35Z

pkg/operator/controller/names.go

+	name := fmt.Sprintf("%s-%s", gateway.Name, util.Hash(host))
+	if strings.HasPrefix(host, "*.") {
+		name = name + "-wildcard"
+	}
 	return types.NamespacedName{
 		Namespace: gateway.Namespace,
-		Name:      fmt.Sprintf("%s-%s-wildcard", gateway.Name, util.Hash(host)),
+		Name:      name,


We can't change this, the Listener's DNSRecord will always be a wildcard.

openshift-merge-robot · 2025-01-09T17:18:54Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-05-15T13:56:56Z

@rfredette: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-single-node	`2b5a03e`	link	false	`/test e2e-aws-ovn-single-node`
ci/prow/hypershift-e2e-aks	`2b5a03e`	link	true	`/test hypershift-e2e-aks`
ci/prow/verify-deps	`2b5a03e`	link	true	`/test verify-deps`
ci/prow/e2e-aws-ovn-hypershift-conformance	`2b5a03e`	link	true	`/test e2e-aws-ovn-hypershift-conformance`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rfredette · 2025-08-13T21:22:16Z

Closing because this is superceded by #1229 .

openshift-ci-robot · 2025-08-13T21:22:19Z

@rfredette: This pull request references Jira Issue OCPBUGS-31521. The bug has been updated to no longer refer to the pull request using the external bug tracker.

In response to this:

If a gateway attempts to create a listener for a domain that's already served by an ingress controller, don't create a DNSRecord for that domain, and log an error.

In the future, some more visible method of error reporting should be added, such as an alert or a status condition on a relevant object, but that is intentionally left for a future change.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Sep 12, 2024

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Sep 12, 2024

openshift-ci bot requested review from Thealisyed, alebedev87 and lihongan September 12, 2024 20:41

openshift-ci bot assigned candita Sep 18, 2024