Configure External DNS

This page walks you through the process of deploying and validating external DNS for your Kubernetes Operator components deployed across multiple Kubernetes clusters without a service mesh.

Prerequisites

Before you begin, perform the following tasks:

Install kubectl.
Update as needed and set the environment variables defined in the following env_variables.sh file.
```
1# This script builds on top of the environment configured in the setup guides.2# It depends (uses) the following env variables defined there to work correctly.3# If you don't use the setup guide to bootstrap the environment, then define them here.4#  ${K8S_CLUSTER_0}5#  ${K8S_CLUSTER_1}6#  ${K8S_CLUSTER_2}7#  ${K8S_CLUSTER_0_ZONE}8#  ${K8S_CLUSTER_1_ZONE}9#  ${K8S_CLUSTER_2_ZONE}10#  ${K8S_CLUSTER_0_CONTEXT_NAME}11#  ${K8S_CLUSTER_1_CONTEXT_NAME}12#  ${K8S_CLUSTER_2_CONTEXT_NAME}13#  ${MDB_GKE_PROJECT}14
15export DNS_SA_NAME="ext-dns-sa${K8S_CLUSTER_SUFFIX:-}"16export DNS_SA_EMAIL="${DNS_SA_NAME}@${MDB_GKE_PROJECT}.iam.gserviceaccount.com"17
18export CUSTOM_DOMAIN="mongodb.custom"19export DNS_ZONE="mongodb${K8S_CLUSTER_SUFFIX:-}"
```

Source Code

You can find all included source code in the MongoDB Kubernetes Operator repository.

Procedure

Create a GCP service account for ExternalDNS.

gcloud iam service-accounts create "${DNS_SA_NAME}" --display-name "${DNS_SA_NAME}"

Add the DNS admin role to your GCP service account.

gcloud projects add-iam-policy-binding "${MDB_GKE_PROJECT}" --member serviceAccount:"${DNS_SA_EMAIL}" --role roles/dns.admin

Create GCP service account key.

mkdir -p secrets
gcloud iam service-accounts keys create secrets/external-dns-sa-key.json --iam-account="${DNS_SA_EMAIL}"

Create a Kubernetes namespace for deploying ExternalDNS.

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create ns external-dns

Create a Kubernetes Secret containing the service account key.

# create secret with service account keykubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json

Install ExternalDNS.

ExternalDNS makes Kubernetes resources discoverable via public DNS servers. Deploy the eternal-dns Kubernetes deployment and related permissions objects to the namespace you just created.

# Render the manifest once so ${DNS_ZONE}/${CUSTOM_DOMAIN} are substituted.rendered_manifest=$(eval "cat <<EOF$(cat yamls/externaldns.yaml)EOF")
echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns apply -f -echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns apply -f -echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns apply -f -

apiVersion: v1kind: ServiceAccountmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dns---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsrules:  - apiGroups: [""]    resources: ["services","endpoints","pods","nodes"]    verbs: ["get","watch","list"]  - apiGroups: ["extensions","networking.k8s.io"]    resources: ["ingresses"]    verbs: ["get","watch","list"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: external-dns-viewer  labels:    app.kubernetes.io/name: external-dnsroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: external-dnssubjects:  - kind: ServiceAccount    name: external-dns    namespace: external-dns---apiVersion: apps/v1kind: Deploymentmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsspec:  strategy:    type: Recreate  selector:    matchLabels:      app.kubernetes.io/name: external-dns  template:    metadata:      labels:        app.kubernetes.io/name: external-dns    spec:      serviceAccountName: external-dns      containers:        - name: external-dns          image: registry.k8s.io/external-dns/external-dns:v0.16.1          args:            - --source=service            - --source=ingress            - --provider=google            - --google-zone-visibility=private            - --zone-id-filter=${DNS_ZONE}            - --domain-filter=${CUSTOM_DOMAIN}            - --log-format=json # google cloud logs parses severity of the "text" log format incorrectly            - --interval=10s            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization            - --registry=txt      #     # uncomment below if static credentials are used          env:             - name: GOOGLE_APPLICATION_CREDENTIALS               value: /etc/secrets/service-account/credentials.json          volumeMounts:             - name: google-service-account               mountPath: /etc/secrets/service-account/      volumes:         - name: google-service-account           secret:             secretName: external-dns-sa-secret

Set up the DNS zone.

This example includes a private DNS zone. This means that you can only access the resources deployed in the DNS zone from the GKE clusters we created. If you are planning to access your resources from outside your GKE clusters, use a public DNS zone. To do so, you must have a registered domain.

FQ_CLUSTER_0="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_0_ZONE}/clusters/${K8S_CLUSTER_0}"FQ_CLUSTER_1="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_1_ZONE}/clusters/${K8S_CLUSTER_1}"FQ_CLUSTER_2="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_2_ZONE}/clusters/${K8S_CLUSTER_2}"
gcloud dns managed-zones create "${DNS_ZONE}" \  --description="" \  --dns-name="${CUSTOM_DOMAIN}" \  --visibility="private" \  --gkeclusters="${FQ_CLUSTER_0}","${FQ_CLUSTER_1}","${FQ_CLUSTER_2}"

Back

GKE Clusters

Deploy the Operator