Repository: kinvolk/lokomotive
Pull request #207 (2020-03-23 10:58:26)

components/external-dns: expose owner_id
We were setting it to the AWS DNS Zone ID and that means that several
clusters using the same DNS Zone will interact badly with each other.

This exposes it to the user so they can choose a reasonable ID.


Patch:
diff --git a/ci/aws/aws-cluster.lokocfg.envsubst b/ci/aws/aws-cluster.lokocfg.envsubst
index 88672c53..a6f9849e 100644
--- a/ci/aws/aws-cluster.lokocfg.envsubst
+++ b/ci/aws/aws-cluster.lokocfg.envsubst
@@ -40,7 +40,8 @@ component "cert-manager" {
 }
 
 component "external-dns" {
-  policy = "sync"
+  policy   = "sync"
+  owner_id = "$CLUSTER_ID"
   aws {
     zone_id               = "$AWS_DNS_ZONE_ID"
     aws_access_key_id     = "$AWS_ACCESS_KEY_ID"
diff --git a/ci/packet/packet-cluster.lokocfg.envsubst b/ci/packet/packet-cluster.lokocfg.envsubst
index 0ec04941..fec3deb0 100644
--- a/ci/packet/packet-cluster.lokocfg.envsubst
+++ b/ci/packet/packet-cluster.lokocfg.envsubst
@@ -47,7 +47,8 @@ component "cert-manager" {
 }
 
 component "external-dns"{
-  policy = "sync"
+  policy   = "sync"
+  owner_id = "$CLUSTER_ID"
   aws {
     zone_id = "$AWS_DNS_ZONE_ID"
     aws_access_key_id = "$AWS_ACCESS_KEY_ID"
diff --git a/docs/configuration-reference/backend/s3.md b/docs/configuration-reference/backend/s3.md
index eec0d8db..9a39a8d4 100644
--- a/docs/configuration-reference/backend/s3.md
+++ b/docs/configuration-reference/backend/s3.md
@@ -20,7 +20,7 @@ used.
 ## Prerequisites
 
 * AWS S3 bucket to be used should already be created.
-* DynamoDB table to be used for state locking should already be created. The table must have a primary key named LockID.
+* DynamoDB table to be used for state locking should already be created.
 * Correct IAM permissions for the S3 bucket and DynamoDB Table. At minimum the following are the
   permissions required:
   * [S3 bucket permissions](https://www.terraform.io/docs/backends/types/s3.html#s3-bucket-permissions).
@@ -44,14 +44,14 @@ backend "s3" {
 
 ## Attribute reference
 
-| Argument                    | Description                                                                                                  | Default | Required |
-|-----------------------------|--------------------------------------------------------------------------------------------------------------|:-------:|:--------:|
-| `backend.s3`                | AWS S3 backend configuration block.                                                                          | -       | false    |
-| `backend.s3.bucket`         | Name of the S3 bucket where Lokomotive stores cluster state.                                                 | -       | true     |
-| `backend.s3.key`            | Path in the S3 bucket to store the cluster state.                                                            | -       | true     |
-| `backend.s3.region`         | AWS Region of the S3 bucket.                                                                                 | -       | false    |
-| `backend.s3.aws_creds_path` | Path to the AWS credentials file.                                                                            | -       | false    |
-| `backend.s3.dynamodb_table` | Name of the DynamoDB table for locking the cluster state. The table must have a primary key named LockID.    | -       | false    |
+| Argument                    | Description                                                  | Default | Required |
+|-----------------------------|--------------------------------------------------------------|:-------:|:--------:|
+| `backend.s3`                | AWS S3 backend configuration block.                          | -       | false    |
+| `backend.s3.bucket`         | Name of the S3 bucket where Lokomotive stores cluster state. | -       | true     |
+| `backend.s3.key`            | Path in the S3 bucket to store the cluster state.            | -       | true     |
+| `backend.s3.region`         | AWS Region of the S3 bucket.                                 | -       | false    |
+| `backend.s3.aws_creds_path` | Path to the AWS credentials file.                            | -       | false    |
+| `backend.s3.dynamodb_table` | Name of the DynamoDB table for locking the cluster state.    | -       | false    |
 
 >NOTE: In order for the installer to configure the credentials for S3 backend either pass them as
 environment variables or in the config above.
diff --git a/docs/configuration-reference/components/external-dns.md b/docs/configuration-reference/components/external-dns.md
index 2a240d31..ae027f5c 100644
--- a/docs/configuration-reference/components/external-dns.md
+++ b/docs/configuration-reference/components/external-dns.md
@@ -59,17 +59,18 @@ Table of all the arguments accepted by the component.
 
 Example:
 
-| Argument                    | Description                                                                                                       | Default        | Required |
-|-----------------------------|-------------------------------------------------------------------------------------------------------------------|:--------------:|:--------:|
-| `sources`                   | Kubernetes resources type to be observed for new DNS entries by ExternalDNS.                                      | ["service"]    | false    |
-| `namespace`                 | Namespace to install ExternalDNS.                                                                                 | "external-dns" | false    |
-| `policy`                    | Modify how DNS records are sychronized between sources and providers (options: sync, upsert-only).                | "upsert-only"  | false    |
-| `metrics`                   | Enable metrics collection by Prometheus. Needs [Prometheus Operator component](prometheus-operator.md) installed. | false          | false    |
-| `aws`                       | Configuration block for AWS Route53 DNS provider.                                                                 | -              | true     |
-| `aws.zone_type`             | Filter for zones of this type (options: public, private).                                                         | "public"       | false    |
-| `aws.zone_id`               | ID of the DNS zone.                                                                                               | -              | true     |
-| `aws.aws_access_key_id`     | AWS access key ID for AWS credentials. Use environment variable AWS_ACCESS_KEY_ID instead.                        | -              | false    |
-| `aws.aws_secret_access_key` | AWS secret access key for AWS credentials. Use environment variable AWS_SECRET_ACCESS_KEY instead.                | -              | false    |
+| Argument                    | Description                                                                                                                                           | Default        | Required |
+|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------:|:--------:|
+| `sources`                   | Kubernetes resources type to be observed for new DNS entries by ExternalDNS.                                                                          | ["service"]    | false    |
+| `namespace`                 | Namespace to install ExternalDNS.                                                                                                                     | "external-dns" | false    |
+| `policy`                    | Modify how DNS records are sychronized between sources and providers (options: sync, upsert-only).                                                    | "upsert-only"  | false    |
+| `metrics`                   | Enable metrics collection by Prometheus. Needs [Prometheus Operator component](prometheus-operator.md) installed.                                     | false          | false    |
+| `owner_id`                  | A name that identifies this instace of ExternalDNS. Set it to a unique value across the DNS zone that doesn't change for the lifetime of the cluster. | -              | true     |
+| `aws`                       | Configuration block for AWS Route53 DNS provider.                                                                                                     | -              | true     |
+| `aws.zone_type`             | Filter for zones of this type (options: public, private).                                                                                             | "public"       | false    |
+| `aws.zone_id`               | ID of the DNS zone.                                                                                                                                   | -              | true     |
+| `aws.aws_access_key_id`     | AWS access key ID for AWS credentials. Use environment variable AWS_ACCESS_KEY_ID instead.                                                            | -              | false    |
+| `aws.aws_secret_access_key` | AWS secret access key for AWS credentials. Use environment variable AWS_SECRET_ACCESS_KEY instead.                                                    | -              | false    |
 
 ## Applying
 
diff --git a/pkg/components/external-dns/component.go b/pkg/components/external-dns/component.go
index 6b9a8de0..0b710ab1 100644
--- a/pkg/components/external-dns/component.go
+++ b/pkg/components/external-dns/component.go
@@ -43,7 +43,7 @@ aws:
     secretKey: "{{ .AwsConfig.SecretAccessKey }}"
     accessKey: "{{ .AwsConfig.AccessKeyID }}"
   zoneType: {{ .AwsConfig.ZoneType }}
-txtOwnerId: {{ .AwsConfig.ZoneID }}
+txtOwnerId: {{ .OwnerID }}
 {{- end }}
 policy: {{ .Policy }}
 replicas: 3
@@ -68,6 +68,7 @@ type component struct {
 	Metrics   bool      `hcl:"metrics,optional"`
 	Policy    string    `hcl:"policy,optional"`
 	AwsConfig AwsConfig `hcl:"aws,block"`
+	OwnerID   string    `hcl:"owner_id"`
 }
 
 func newComponent() *component {


Test patch:
diff --git a/pkg/components/external-dns/component_test.go b/pkg/components/external-dns/component_test.go
index db67c31d..4fe183b1 100644
--- a/pkg/components/external-dns/component_test.go
+++ b/pkg/components/external-dns/component_test.go
@@ -68,6 +68,7 @@ func TestAwsConfigWithoutProvidingCredentials(t *testing.T) {
    sources = ["service"]
    metrics =  false
    policy = "upsert-only"
+   owner_id = "test-owner"
    aws {
      zone_id = "TESTZONEID"
      zone_type = "public"
@@ -97,6 +98,7 @@ func TestAwsConfigBySettingEnvVariables(t *testing.T) {
     sources = ["service"]
     metrics =  false
     policy = "upsert-only"
+    owner_id = "test-owner"
     aws {
       zone_id = "TESTZONEID"
       zone_type = "public"
@@ -133,6 +135,7 @@ func TestAwsConfigBySettingEmptyEnvVariables(t *testing.T) {
     sources = ["service"]
     metrics =  false
     policy = "upsert-only"
+    owner_id = "test-owner"
     aws {
       zone_id = "TESTZONEID"
       zone_type = "public"
@@ -168,6 +171,7 @@ func TestAwsConfigBySettingConfigFields(t *testing.T) {
     sources = ["service"]
     metrics =  false
     policy = "upsert-only"
+    owner_id = "test-owner"
     aws {
       zone_id = "TESTZONEID"
       zone_type = "public"