How the default DNSProvider should be created?

[kmadac]

Hi,

This is not a bug or request, but rather a question. It is not clear to me if default DNSProvider should be create manually or it should be created automatically? I have shoot cluster created via gardener dashboard, where I added DNS secret my-openstack-designate-secret2. Then I added shoot dns extension in Shoot object:

  dns:
    domain: psh-mcm12.test.t-sov.live
    providers:
      - primary: true
        secretName: my-openstack-designate-secret2
        type: openstack-designate
  extensions:
    - type: shoot-dns-service
      providerConfig:
        apiVersion: service.dns.extensions.gardener.cloud/v1alpha1
        kind: DNSConfig
        dnsProviderReplication:
          enabled: true

I would expect that DNSProvider specified in Shoot object will be created automatically, but it is not. Is my expectation correct?

Thanks

[MartinWeindel]

For the records: this is more a question for the shoot-dns-service extension

But back to your question:

I would expect that DNSProvider specified in Shoot object will be created automatically, but it is not. Is my expectation correct?

Yes, you should see something like

  extensions:
    - type: shoot-dns-service
      providerConfig:
        apiVersion: service.dns.extensions.gardener.cloud/v1alpha1
        kind: DNSConfig
        dnsProviderReplication:
          enabled: true
        providers:
          - secretName: shoot-dns-service-my-openstack-designate-secret2
            type: openstack-designate
        syncProvidersFromShootSpecDNS: true

The providerConfig.providers section is updated by the shoot-dns-service admission controller. You should check if it is running on the Gardener cluster. Additionally, there is one important line missing in your snippet: syncProvidersFromShootSpecDNS: true Without this line, the admission controller will not consider changes from the spec.dns.providers section.

[kmadac]

Thanks for response. I adjusted the Shoot configuration but providerConfig.providers was not updated. I investigated the admission controller you mentioned and it seems it is not running. Did you mean admission controller from gardener-extension-shoot-dns-service project here - https://github.com/gardener/gardener-extension-shoot-dns-service/tree/master/cmd/gardener-extension-admission-shoot-dns-service?

I wasn't able to find any documentation on this topic (automatic creation of DNSProviders with admission controller) ? Is there any documentation available somewhere?

Thank you.

[MartinWeindel]

You may take a look how the garden-setup project is installing this components. See

• https://github.com/gardener/garden-setup/blob/af5c8feae1cbde1d15bf0ebff5b85d44f65ba524/docs/extended/gardener.md#admission-controllers
• https://github.com/gardener/garden-setup/blob/af5c8feae1cbde1d15bf0ebff5b85d44f65ba524/components/gardener/extensions/component.yaml#L30
• https://github.com/gardener/garden-setup/blob/master/components/gardener/extensions/deployment.yaml#L561-L592

In the end you have to apply the charts https://github.com/gardener/gardener-extension-shoot-dns-service/tree/master/charts/gardener-extension-admission-shoot-dns-service/charts/application to the Garden runtime cluster and https://github.com/gardener/gardener-extension-shoot-dns-service/tree/master/charts/gardener-extension-admission-shoot-dns-service/charts/virtual to the virtual garden.

[kmadac]

Thank you veru much for all the information. I'm closing the issue.