-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Description
What would you like to be added:
Support for a external-dns.alpha.kubernetes.io/gateway-hostname-source
annotation, that is the equivalent of the external-dns.alpha.kubernetes.io/ingress-hostname-source
, but for *Route resources.
Why is this needed:
We have an External DNS annotation on an ExternalName service that's creating a CNAME in a public zone from one domain (company.public.example.com) to another (company.private.example.com) when a customer has private networking (via AWS PrivateLink, for example) set up.
Customers need to be able to resolve most of their traffic over the private endpoint, so they set up DNS for company.private.example.com
to point to their internal VPC endpoint. The CNAME then directs traffic from company.public.example.com
to company.private.example.com
which resolves privately to their internal endpoint. This is then directed to our Gateway API private load balancer, then routed in-cluster.
Some limited traffic from third-party services that our customers use (namely SCIM) cannot traverse this private endpoint, so we need to have that traffic be able to resolve company.private.example.com
to our public gateway instead. Inside their network, that will still resolve to their internal endpoint, but those third-party services will be able to send traffic to the public endpoint (which will only handle traffic for a \scim
endpoint and blackhole everything else).
The problem is that the hostname those third-party services will have to use is company.public.example.com
, so that's the hostname that we need to use on our HTTPRoute. We don't want to override our CNAME however, or that will break our customers other operations. We want external DNS to create ONLY an A record for company.private.example.com
-> public gateway loadbalancer DNS, but the default behavior is to add both the hostname annotations and the hostname defined in the HTTPRoute spec, which causes it to override our ExernalName service's CNAME record with a message like this:
Domain comapny.public.example.com. contains conflicting record type candidates; discarding CNAME record"
If there we could set an annotation like external-dns.alpha.kubernetes.io/gateway-hostname-source: annotation-only
to ignore the hostname in the spec, that would solve our problem. As it stands now, we have to use an Ingress instead, which we're trying to deprecated in favor of Gateway API.