Bug 1869387

Summary:	Create CNAME instead of Alias Records for AWS GovCloud Regions
Product:	OpenShift Container Platform	Reporter:	Daneyon Hansen <dhansen>
Component:	Networking	Assignee:	Daneyon Hansen <dhansen>
Networking sub component:	router	QA Contact:	Hongan Li <hongli>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	unspecified	CC:	aos-bugs, bleanhar
Version:	4.6
Target Milestone:	---
Target Release:	4.6.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-27 16:28:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Daneyon Hansen 2020-08-17 19:25:15 UTC

Description of problem:
From [1]:

"You can create private hosted zones in the AWS GovCloud (US). In general, the functionality is the same as for private hosted zones in the global version of Route 53. However, you can create alias records only when the alias target is another record in the same hosted zone. To route traffic to another AWS resource, such as an ELB load balancer or an S3 bucket, you can use a CNAME record instead of an alias record unless you're creating a record at the zone apex."

When the platform is AWS and the region is "us-gov-west-1" or "us-gov-east-1", the Ingress Operator should use a CNAME record type when creating the ingress domain wildcard record.

Version-Release number of selected component (if applicable):
4.6

How reproducible:
Always

Steps to Reproduce:
1. N/A

Actual results:
The ingress domain wildcard record is not created due to the limitations specified in [1].

Expected results:
The ingress domain wildcard record is created due to the limitations specified in [1].

Additional info:
[1] https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html

Comment 1 Daneyon Hansen 2020-08-17 19:29:36 UTC

xref: https://github.com/openshift/installer/pull/4043 )installer fix for same bug)

Comment 4 Hongan Li 2020-09-10 02:32:26 UTC

verified with 4.6.0-0.nightly-2020-09-09-021653 and passed.

$ oc get clusterversion
NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.6.0-0.nightly-2020-09-09-021653   True        False         75m     Cluster version is 4.6.0-0.nightly-2020-09-09-021653

$ aws --profile gov --region us-gov-west-1 route53 list-resource-record-sets --hosted-zone-id $zone_id --query 'ResourceRecordSets[?contains(Name,`apps`)==`true`]'
[
    {
        "Name": "\\052.apps.yunjiang-debug7.qe.devcluster.openshift.com.",
        "Type": "CNAME",
        "TTL": 30,
        "ResourceRecords": [
            {
                "Value": "internal-ad61fd41e2ca545658d7a1c49de4782d-1800445331.us-gov-west-1.elb.amazonaws.com"
            }
        ]
    }
]


spec:
  dnsName: '*.apps.yunjiang-debug7.qe.devcluster.openshift.com.'
  recordTTL: 30
  recordType: CNAME
  targets:
  - internal-ad61fd41e2ca545658d7a1c49de4782d-1800445331.us-gov-west-1.elb.amazonaws.com

status:
  <---snip--->
  platform: AWS
  platformStatus:
    aws:
      region: us-gov-west-1

Comment 6 errata-xmlrpc 2020-10-27 16:28:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4196