Add internalDNSRecords field #2460

cybertron · 2025-08-26T21:49:21Z

No description provided.

openshift-ci · 2025-08-26T21:49:26Z

Hello @cybertron! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

openshift-ci · 2025-08-26T21:49:27Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

everettraven · 2025-08-29T16:55:00Z

config/v1/types_infrastructure.go

+	// api, api-int, and ingress.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:Enum=Enabled;Disabled
+	// +openshift:validation:featureGate=OnPremInternalDNSRecords


AFAIK, this isn't a real marker. Let's remove this.

Heh, yeah I was throwing stuff at the wall when I had trouble with the feature gate.

everettraven · 2025-08-29T16:55:42Z

config/v1/types_infrastructure.go


+	// internalDNSRecords determines whether we deploy with internal records enabled for
+	// api, api-int, and ingress.
+	// +kubebuilder:validation:Optional


This is essentially a duplicate of the +optional marker below. We prefer the use of the +optional marker so let's remove this one.

everettraven · 2025-08-29T18:10:42Z

config/v1/types_infrastructure.go

+	// +openshift:validation:featureGate=OnPremInternalDNSRecords
+	// +openshift:enable:FeatureGate=OnPremInternalDNSRecords
+	// +optional
+	InternalDNSRecords InternalDNSRecordsType `json:"internalDNSRecords"`


Because this is an optional field and the zero value is invalid, this should have omitempty.

everettraven · 2025-08-29T18:14:46Z

config/v1/types_infrastructure.go

+type InternalDNSRecordsType string
+
+const (
+	InternalDNSRecordsDisabled InternalDNSRecordsType = "Disabled"
+	InternalDNSRecordsEnabled InternalDNSRecordsType = "Enabled"
+)


Normally we try to avoid the terminology Enabled and Disabled where possible because the terms can often be overloaded and cause confusion.

What if instead of naming the field this applies to internalDNSRecords, what if we named it something like dnsRecordsPolicy (or maybe dnsRecordsType? not sure which one is better) and we had Internal and External as the options?

everettraven · 2025-08-29T18:17:34Z

config/v1/types_infrastructure.go

+	// internalDNSRecords determines whether we deploy with internal records enabled for
+	// api, api-int, and ingress.


Please include validation constraints in the GoDoc here so that this is more end-user friendly. This is the text used in our generated API documentation and what users will see when they use something like oc explain ... so we should make sure it reads appropriately as end-user documentation.

Some good guidelines for things to take into consideration for inclusion in the GoDoc are here: https://github.com/openshift/enhancements/blob/master/dev-guide/api-conventions.md#write-user-readable-documentation-in-godoc

everettraven · 2025-08-29T18:21:26Z

config/v1/types_infrastructure.go

+	// internalDNSRecords determines whether we deploy with internal records enabled for
+	// api, api-int, and ingress.
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:Enum=Enabled;Disabled
+	// +openshift:validation:featureGate=OnPremInternalDNSRecords
+	// +openshift:enable:FeatureGate=OnPremInternalDNSRecords
+	// +optional
+	InternalDNSRecords InternalDNSRecordsType `json:"internalDNSRecords"`
+


This looks like we have only added this to the BareMetalPlatformStatus type? Is this because the OpenShift installer will end up setting this value at install time?

If I understand the EP correctly as well, this sounds like this should only be possible to set when loadBalancer is set to UserManaged?

Do we need some additional validation logic (maybe a CEL expression) to enforce that?

Yes, this will be populated by the installer. I have a validation in the installer to ensure it isn't set when it shouldn't be, but I can move that here if it would be better.

I should also note that this is only a partial version of the change. Because these are per-platform types we'll need to apply the same change to the other on-prem platforms once we know what it should look like.

JoelSpeed · 2025-09-09T13:56:08Z

/test lint

openshift-ci · 2025-09-17T19:47:22Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joelspeed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

cybertron · 2025-09-17T20:17:34Z

I think this latest revision should address all of the comments so far, except moving the validation to the api layer. If we ever make this modifiable after initial install we'll have to do that, but I'd just as soon defer that effort until/if it's needed. Willing to move it here if you'd prefer though.

JoelSpeed · 2025-09-18T13:37:24Z

config/v1/types_infrastructure.go

 	// +optional
 	LoadBalancer *BareMetalPlatformLoadBalancer `json:"loadBalancer,omitempty"`

+	// DNSRecordsType determines whether records for api, api-int, and ingress


Suggested change

// DNSRecordsType determines whether records for api, api-int, and ingress

// dnsRecordsType determines whether records for api, api-int, and ingress

JoelSpeed · 2025-09-18T13:39:22Z

config/v1/types_infrastructure.go

+	// are provided by the internal DNS service or externally. `Internal` configures
+	// DNS records in the internal service. `External` means no records will be


Internal allows DNS resolution for components within the cluster right? It's configuring coredns?

everettraven · 2025-09-19T13:53:24Z

config/v1/types_infrastructure.go

+	// DNSRecordsType determines whether records for api, api-int, and ingress
+	// are provided by the internal DNS service or externally. `Internal` configures
+	// DNS records in the internal service. `External` means no records will be
+	// provided and must be configured external to the cluster. `External` is only
+	// allowed when a user-managed loadbalancer is configured. When unset, the
+	// internal records will be provided.
+	// api, api-int, and ingress.


For enum based fields we generally try to follow a pattern like:

dnsRecordsType ...
Allowed values are Internal, External, and omitted.
When set to Internal, ...
When set to External, ...
When omitted, ...

everettraven · 2025-09-19T13:53:54Z

config/v1/types_infrastructure.go

+	DNSRecordsExternal DNSRecordsType = "External"
+	DNSRecordsInternal DNSRecordsType = "Internal"


Suggested change

DNSRecordsExternal DNSRecordsType = "External"

DNSRecordsInternal DNSRecordsType = "Internal"

DNSRecordsTypeExternal DNSRecordsType = "External"

DNSRecordsTypeInternal DNSRecordsType = "Internal"

everettraven · 2025-09-19T13:56:55Z

If we ever make this modifiable after initial install we'll have to do that, but I'd just as soon defer that effort until/if it's needed. Willing to move it here if you'd prefer though.

Is this API currently immutable? How do we enforce that?

openshift-ci · 2025-09-19T15:48:51Z

@cybertron: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 26, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 26, 2025

openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Aug 26, 2025

cybertron mentioned this pull request Aug 26, 2025

OPNET-678: Make VIPs optional with external loadbalancer openshift/enhancements#1803

Open

everettraven reviewed Aug 29, 2025

View reviewed changes

cybertron added 3 commits September 16, 2025 16:57

Add internalDNSRecords field

6707201

Rename to DNSRecordsType

305b55f

Update API definition

09cb604

cybertron force-pushed the disable-internal-dns branch from 3ddd0ad to 09cb604 Compare September 17, 2025 19:47

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 17, 2025

JoelSpeed reviewed Sep 18, 2025

View reviewed changes

everettraven reviewed Sep 19, 2025

View reviewed changes

		// internalDNSRecords determines whether we deploy with internal records enabled for
		// api, api-int, and ingress.

	// DNSRecordsType determines whether records for api, api-int, and ingress
	// dnsRecordsType determines whether records for api, api-int, and ingress

		// are provided by the internal DNS service or externally. `Internal` configures
		// DNS records in the internal service. `External` means no records will be

		DNSRecordsExternal DNSRecordsType = "External"
		DNSRecordsInternal DNSRecordsType = "Internal"

Add internalDNSRecords field #2460

Are you sure you want to change the base?

Add internalDNSRecords field #2460

Conversation

cybertron commented Aug 26, 2025

Uh oh!

openshift-ci bot commented Aug 26, 2025

Uh oh!

openshift-ci bot commented Aug 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JoelSpeed commented Sep 9, 2025

Uh oh!

openshift-ci bot commented Sep 17, 2025

Uh oh!

cybertron commented Sep 17, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

everettraven commented Sep 19, 2025

Uh oh!

openshift-ci bot commented Sep 19, 2025

Uh oh!

Uh oh!