This is a cache of https://docs.okd.io/4.17/networking/networking_operators/external_dns_operator/nw-creating-dns-records-on-aws.html. It is a snapshot of the page at 2026-02-11T00:36:32.890+0000.
Creating <strong>dns</strong> records on AWS - Networking Operators | Networking | OKD 4.17
  1. Documentation
×

Creating dns records on AWS

To create dns records on AWS and AWS GovCloud, use the External dns Operator. The Operator manages external name resolution for your cluster services directly through the Operator.

Creating dns records on a public hosted zone for AWS by using Red Hat External dns Operator

You can create dns records on a public hosted zone for AWS by using the Red Hat External dns Operator. You can use the same instructions to create dns records on a hosted zone for AWS GovCloud.

Procedure

  1. Check the user profile by running the following command. The profile, such as system:admin, must have access to the kube-system namespace. If you do not have the credentials, you can fetch the credentials from the kube-system namespace to use the cloud provider client by running the following command:

    $ oc whoami

  2. Fetch the values from the aws-creds secret that exists in the kube-system namespace.

    $ export AWS_ACCESS_KEY_ID=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_access_key_id}} | base64 -d)
    $ export AWS_SECRET_ACCESS_KEY=$(oc get secrets aws-creds -n kube-system  --template={{.data.aws_secret_access_key}} | base64 -d)

  3. Get the routes to check the domain:

    $ oc get routes --all-namespaces | grep console
    Example output
    openshift-console          console             console-openshift-console.apps.testextdnsoperator.apacshift.support                       console             https   reencrypt/Redirect     None
openshift-console          downloads           downloads-openshift-console.apps.testextdnsoperator.apacshift.support                     downloads           http    edge/Redirect          None

  4. Get the list of dns zones and find the dns zone that corresponds to the domain of the route that you previously queried:

    $ aws route53 list-hosted-zones | grep testextdnsoperator.apacshift.support
    Example output
    HOSTEDZONES	terraform	/hostedzone/Z02355203TNN1XXXX1J6O	testextdnsoperator.apacshift.support.	5

  5. Create the Externaldns CR for the route source:

    $ cat <<EOF | oc create -f -
apiVersion: externaldns.olm.openshift.io/v1beta1
kind: Externaldns
metadata:
  name: sample-aws
spec:
  domains:
  - filterType: Include
    matchType: Exact
    name: testextdnsoperator.apacshift.support
  provider:
    type: AWS
  source:
    type: OpenShiftRoute
    openshiftRouteOptions:
      routerName: default
EOF

    where:

    metadata.name

    Specifies the name of the external dns resource.

    spec.domains

    By default all hosted zones are selected as potential targets. You can include a hosted zone that you need.

    domains.matchType

    Specifies that the matching of the domain from the target zone has to be exact. Exact as opposed to regular expression match.

    domains.name

    Specifies the exact domain of the zone you want to update. The hostname of the routes must be subdomains of the specified domain.

    provider.type

    Specifies the AWS Route53 dns provider.

    source

    Specifies the options for the source of dns records.

    source.type

    Specifies the OpenShiftRoute resource as the source for the dns records which gets created in the previously specified dns provider.

    openshiftRouteOptions.routerName

    If the source is OpenShiftRoute, then you can pass the OpenShift Ingress Controller name. External dns Operator selects the canonical hostname of that router as the target while creating the CNAME record.

  6. Check the records created for OKD routes by using the following command:

    $ aws route53 list-resource-record-sets --hosted-zone-id Z02355203TNN1XXXX1J6O --query "ResourceRecordSets[?Type == 'CNAME']" | grep console

Creating dns records in a different AWS account by using a shared VPC

To create dns records in a different AWS account, configure the Externaldns Operator to use a shared Virtual Private Cloud (VPC). Your organization can then use a single Route 53 instance for name resolution across multiple accounts and projects.

Prerequisites

  • You have created two Amazon AWS accounts: one with a VPC and a Route 53 private hosted zone configured (Account A), and another for installing a cluster (Account B).

  • You have created an IAM Policy and IAM Role with the appropriate permissions in Account A for Account B to create dns records in the Route 53 hosted zone of Account A.

  • You have installed a cluster in Account B into the existing VPC for Account A.

  • You have installed the Externaldns Operator in the cluster in Account B.

Procedure

  1. Get the Role ARN of the IAM Role that you created to allow Account B to access Account A’s Route 53 hosted zone by running the following command:

    $ aws --profile account-a iam get-role --role-name user-rol1 | head -1
    Example output
    ROLE	arn:aws:iam::1234567890123:role/user-rol1	2023-09-14T17:21:54+00:00	3600	/	AROA3SGB2ZRKRT5NISNJN	user-rol1

  2. Locate the private hosted zone to use with Account A’s credentials by running the following command:

    $ aws --profile account-a route53 list-hosted-zones | grep testextdnsoperator.apacshift.support
    Example output
    HOSTEDZONES	terraform	/hostedzone/Z02355203TNN1XXXX1J6O	testextdnsoperator.apacshift.support. 5

  3. Create the Externaldns object by running the following command:

    $ cat <<EOF | oc create -f -
apiVersion: externaldns.olm.openshift.io/v1beta1
kind: Externaldns
metadata:
  name: sample-aws
spec:
  domains:
  - filterType: Include
    matchType: Exact
    name: testextdnsoperator.apacshift.support
  provider:
    type: AWS
    aws:
      assumeRole:
        arn: arn:aws:iam::12345678901234:role/user-rol1
  source:
    type: OpenShiftRoute
    openshiftRouteOptions:
      routerName: default
EOF

    where:

    arn

    Specifies the Role ARN to have dns records created in Account A.

  4. Check the records created for OKD routes by entering the following command:

    $ aws --profile account-a route53 list-resource-record-sets --hosted-zone-id Z02355203TNN1XXXX1J6O --query "ResourceRecordSets[?Type == 'CNAME']" | grep console-openshift-console