Chapter 5. Configuring DNS provider credentials
Chapter 5. Configuring DNS provider credentials If you want to configure DNS policies in Connectivity Link, you must configure credentials for at least one of the following supported cloud-based DNS providers: Amazon Route 53 Google Cloud DNS Microsoft Azure DNS Note You must perform the steps for your chosen DNS provider on each OpenShift cluster that you want to use Connectivity Link on. You must configure the secret for the DNS provider in the same namespace that will include your Gateway. Prerequisites See Chapter 1, Connectivity Link prerequisites and permissions . You have access to the namespace in which your Gateway will be created, for example, api-gateway . Note This guide uses environment variables for convenience only. If you know the environment variable values, you can set up the required .yaml files in a way that suits your needs. 5.1. Configuring Amazon DNS provider credentials Procedure Set up your environment variables as follows: These variable values are described as follows: AWS_ACCESS_KEY_ID : Key ID from AWS with Route 53 access. AWS_SECRET_ACCESS_KEY : Key from AWS with Route 53 access. AWS_REGION : Your AWS region, for example, us-east-2 or eu-west-1 . Create a Secret resource for your credentials as follows: In this case, you must set the secret type to aws . Additional resources Amazon Route 53 documentation . 5.2. Configuring Google DNS provider credentials Procedure Set up your environment variables as follows: These variable values are described as follows: GOOGLE : Google credentials JSON file. PROJECT_ID : Google project ID. The GOOGLE variable specifies the JSON credentials generated by the gcloud CLI or by the service account. For example, USDHOME/.config/gcloud/application_default_credentials.json , which contains the following: Create a Secret resource for your credentials as follows: In this case, you must set the secret type to gcp . Additional resources Google Cloud DNS documentation . 5.3. Configuring Azure DNS provider credentials Procedure Create a new Azure service principal for managing DNS as follows: For more details on service principals, see the Microsoft Azure documentation . To grant read and contributor access to the zones that you want managed for the service principal you are using, perform the following steps: Fetch the DNS ID used to grant access to the service principal as follows: Provide reader access to the resource group as follows: Provide contributor access to the DNS zone as follows: Because you are setting up advanced traffic rules for geographic and weighted responses, you must also grant traffic manager and DNS zone access as follows: Create a Secret resource for your credentials as follows: In this case, you must set the secret type to azure . Additional resources Microsoft Azure DNS documentation .
export AWS_ACCESS_KEY_ID=xxxxxxx export AWS_SECRET_ACCESS_KEY=xxxxxxx export AWS_REGION=your-aws-region create secret generic aws-credentials --namespace=api-gateway --type=kuadrant.io/aws --from-literal=AWS_ACCESS_KEY_ID=USDAWS_ACCESS_KEY_ID --from-literal=AWS_SECRET_ACCESS_KEY=USDAWS_SECRET_ACCESS_KEY --from-literal=AWS_REGION=USDAWS_REGION export GOOGLE=xxxxxxx export PROJECT_ID=xxxxxxx {"client_id": "***","client_secret": "***","refresh_token": "***","type": "authorized_user"} create secret generic test-gcp-credentials --namespace=api-gateway --type=kuadrant.io/gcp --from-literal=PROJECT_ID=USDPROJECT_ID --from-file=GOOGLE=USDGOOGLE DNS_NEW_SP_NAME=kuadrantDnsPrincipal DNS_SP=USD(az ad sp create-for-rbac --name USDDNS_NEW_SP_NAME) DNS_SP_APP_ID=USD(echo USDDNS_SP | jq -r '.appId') DNS_SP_PASSWORD=USD(echo USDDNS_SP | jq -r '.password') DNS_ID=USD(az network dns zone show --name example.com --resource-group ExampleDNSResourceGroup --query "id" --output tsv) Get your resource group ID RESOURCE_GROUP_ID=az group show --resource-group ExampleDNSResourceGroup | jq ".id" -r az role assignment create --role "Reader" --assignee USDDNS_SP_APP_ID --scope USDDNS_ID az role assignment create --role "Contributor" --assignee USDDNS_SP_APP_ID --scope USDDNS_ID az role assignment create --role "Traffic Manager Contributor" --assignee USDDNS_SP_APP_ID --scope USDRESOURCE_GROUP_ID az role assignment create --role "DNS Zone Contributor" --assignee USDDNS_SP_APP_ID --scope USDRESOURCE_GROUP_ID cat <<-EOF > /local/path/to/azure.json { "tenantId": "USD(az account show --query tenantId -o tsv)", "subscriptionId": "USD(az account show --query id -o tsv)", "resourceGroup": "ExampleDNSResourceGroup", "aadClientId": "USDDNS_SP_APP_ID", "aadClientSecret": "USDDNS_SP_PASSWORD" } EOF create secret generic test-azure-credentials --namespace=api-gateway --type=kuadrant.io/azure --from-file=azure.json=/local/path/to/azure.json