Red Hat Connectivity Link

Set up DNS

To give your Connectivity Link instance access to your networks, you must set up DNS. You can use external services or on-premise according to your requirements.

Configure DNS provider credentials for AWS

If you want to configure AWS DNS policies in Connectivity Link, you must configure the DNS credentials. You must perform the steps on each OpenShift Container Platform cluster that you want to use Connectivity Link on.

You must configure a DNS hosted zone. The credentials for your DNS provider must have permissions to update DNS records within this zone.

Prerequisites

You installed Connectivity Link on an OpenShift Container Platform cluster.
You have access to the namespace of your gateway, for example, api-gateway.

Note

If you already know your environment variable values, you can create the required YAML files as required for your use case.

Procedure

Optional. Set up your environment variables with the following values:
1. Assign the AWS_ACCESS_KEY_ID environment variable by running the following command:
  $ export AWS_ACCESS_KEY_ID=xxxxxxx
  AWS_ACCESS_KEY_ID: is the ID from AWS with Route 53 access.
2. Assign the AWS_SECRET_ACCESS_KEY environment variable by running the following command:
  $ export AWS_SECRET_ACCESS_KEY=xxxxxxx
  AWS_SECRET_ACCESS_KEY: is the key from AWS with Route 53 access.
3. Assign the AWS_REGION environment variable by running the following command:
  $ export AWS_REGION=your-aws-region
  AWS_REGION: specifies your region, for example, us-east-2 or eu-west-1.

Create a Secret resource for your credentials as follows:

$ oc create secret generic aws-credentials \
  --namespace=api-gateway \
  --type=kuadrant.io/aws \
  --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
  --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
  --from-literal=AWS_REGION=$AWS_REGION

Important

You must configure the Secret in the same namespace where your Gateway object is applied.

Configure Google DNS provider credentials

If you want to configure DNS policies in Connectivity Link using Google Cloud, you must configure the DNS credentials. You must perform the steps on each OpenShift Container Platform cluster that you want to use Connectivity Link on.

You must configure a DNS hosted zone. The credentials for your DNS provider must have permissions to update DNS records within this zone.

Prerequisites

You installed Connectivity Link on an OpenShift Container Platform cluster.
You have access to the namespace of your gateway, for example, api-gateway.

Note

If you already know your environment variable values, you can create the required YAML files as required for your use case.

Procedure

Optional: Specify your GOOGLE environment variable by running the following command:
```
$ export GOOGLE=xxxxxxx
```
GOOGLE: specifies the JSON credentials generated by the gcloud CLI or by the service account. For example, $HOME/.config/gcloud/application_default_credentials.json, which has the following credentials:
```
{"client_id": "***","client_secret": "***","refresh_token": "***","type": "authorized_user"}
```
Optional: Specify your PROJECT_ID environment variable by running the following command:
```
$ export PROJECT_ID=xxxxxxx
```
PROJECT_ID: specifies the Google project ID.

Create a Secret resource for your credentials by running the following command:

$ oc create secret generic test-gcp-credentials \
  --namespace=api-gateway \
  --type=kuadrant.io/gcp \
  --from-literal=PROJECT_ID=$PROJECT_ID \
  --from-file=GOOGLE=$GOOGLE

Important

You must configure the secret in the same namespace as your gateway.

Configure Azure DNS provider credentials

If you want to configure Microsoft Azure DNS policies in Connectivity Link, you must configure the DNS credentials. You must perform the steps on each OpenShift Container Platform cluster that you want to use Connectivity Link on.

You must configure a DNS hosted zone. The credentials for your DNS provider must have permissions to update DNS records within this zone.

Prerequisites

You installed Connectivity Link on an OpenShift Container Platform cluster.
You have access to the namespace where your Gateway object is applied.

Note

If you already know your environment variable values, you can create the required YAML files as required for your use case.

Procedure

Create a new Azure service principal for managing DNS by setting the following environment variables:
1. Set the DNS_NEW_SP_NAME environment variable by running the following command:
  $ export DNS_NEW_SP_NAME=<kuadrantDnsPrincipal>
  Replace <kuadrantDnsPrincipal> with your service principal.
2. Set the DNS_SP environment variable by running the following command:
  $ export DNS_SP=$(az ad sp create-for-rbac --name $DNS_NEW_SP_NAME)
3. Set the DNS_SP_APP_ID environment variable by running the following command:
  $ export DNS_SP_APP_ID=$(echo $DNS_SP | jq -r '.appId')
4. Set the NS_SP_PASSWORD environment variable by running the following command:
  $ export DNS_SP_PASSWORD=$(echo $DNS_SP | jq -r '.password')
  For more details on service principals, see the Service principal object.
Set the resource group environment variable by running the following command:
```
$ export DNS_RESOURCE_GROUP=<ExampleDNSResourceGroup>
```
Replace <ExampleDNSResourceGroup> with the DNS resource group that you want to use.
To grant read and contributor access to the zones that you want managed for the service principal you are using, perform the following steps:
1. Fetch the DNS ID used to grant access to the service principal by running the following command:
  $ DNS_ID=$(az network dns zone show --name <example.com> \ --resource-group $DNS_RESOURCE_GROUP --query "id" --output tsv)
  Replace <example.com> with your DNS zone domain name.
2. Get your resource group ID by running the following command:
  $ RESOURCE_GROUP_ID=$(az group show --resource-group $DNS_RESOURCE_GROUP | jq ".id" -r)
3. Give reader access to the resource group by running the following command:
  $ az role assignment create --role "Reader" --assignee $DNS_SP_APP_ID --scope $DNS_ID
4. Give contributor access to the DNS zone by running the following command:
  $ az role assignment create --role "Contributor" --assignee $DNS_SP_APP_ID --scope $DNS_ID

Because you are setting up advanced traffic rules for geographic and weighted responses, you must also grant traffic manager and DNS zone access by running the following commands:

Create the role assignment for the traffic manager contributor by running the following command:

$ az role assignment create --role "Traffic Manager Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

Create the role assignment for the DNS zone contributor by running the following command:

$ az role assignment create --role "DNS Zone Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

Configure the DNS zone access by running the following command:

$ cat <<-EOF > /local/path/to/azure.json
{
  "tenantId": "$(az account show --query tenantId -o tsv)",
  "subscriptionId": "$(az account show --query id -o tsv)",
  "resourceGroup": "$DNS_RESOURCE_GROUP",
  "aadClientId": "$DNS_SP_APP_ID",
  "aadClientSecret": "$DNS_SP_PASSWORD"
}
EOF

Create a Secret resource for your credentials by running the following command:
```
$ oc create secret generic test-azure-credentials \
  --namespace=api-gateway \
  --type=kuadrant.io/azure \
  --from-file=azure.json=/local/path/to/azure.json
```
Important

You must configure the Secret in the same namespace where your Gateway object is applied.