External DNS for ROSA Custom Domain

Configuring the Custom Domain Operator requires a wildcard CNAME DNS record in your Route53 Hosted Zone. If you do not wish to use a wildcard record, you can use the External DNS Operator to create individual entries for routes.

This document will guide you through deploying and configuring the External DNS Operator with a Custom Domain in ROSA.

Important Note: The ExternalDNS Operator does not support STS yet and uses long lived IAM credentials. This guide will be updated once STS is supported.

Prerequisites

• ROSA Cluster
• AWS CLI
• Route53 Hosted Zone
• A domain

Deploy

Setup Environment

1. Set your email and domain

1. Set remaining environment variables

Custom Domain

Check out the dynamic certificates guide if you do not want to use a wildcard certificate.

1. Create TLS Key Pair for custom domain using certbot:

   Skip this if you already have a key pair.

2. Create TLS secret for custom domain:

   Note use your own keypair paths if not using certbot.

3. Create Custom Domain resource:

4. Wait for the domain to be ready:

External DNS

1. Deploy the External DNS Operator:

2. Wait until the Operator is running:

3. Create IAM Policy document that allows ExternalDNS to update Route53 only in your hosted zone:

4. Create IAM Policy:

5. Create IAM user and attach policy:

   Note: This will be changed to STS using IRSA in the future.

6. Create aws keys for IAM user:

7. Create static credentials:

8. Create secret from credentials:

9. Deploy ExternalDNS controller:

10. Wait until the controller is running:

Test

1. Create a new route to OpenShift console using your domain:

2. Check if DNS record was created automatically by ExternalDNS:

   It may take a few minutes for the record to appear in Route53

3. You can also view the TXT records that indicate they were created by ExternalDNS:

4. Navigate to your custom console domain in the browser and you should see OpenShift login.