Upgrade ExternalDNS

This guide will walk you through upgrading ExternalDNS.

Fast Forward

If you have not deployed ExternalDNS in your cluster, proceed to the What’s Next section.

Fast Forward

If you have already upgraded ExternalDNS, meaning you are upgrading from EKF 1.5-rc1 or later, proceed to the Verify section.

What You’ll Need

• An upgraded management environment.
• An existing Kubernetes cluster.
• An existing Rok deployment.
• Your local clone of the Arrikto GitOps repository.
• Arrikto manifests for EKF version 1.5.3.

Check Your Environment

1. Verify that you have deployed the ExternalDNS deployment in your cluster. Ensure that field READY is 1/1:

   

   root@rok-tools:~/ops/deployments# kubectl get deploy external-dns NAME READY UP-TO-DATE AVAILABLE AGE external-dns 1/1 1 1 1m

Procedure

Warning

The following steps involve deleting and re-creating the DNS records for your EKF services. This means that end-users might face temporary connectivity issues while you are upgrading ExternalDNS. Moreover, due to negative caching, the subdomain (FQDN) of the Load Balancer might not be reachable for up to 30 minutes after the upgrade, depending on the SOA record of the DNS zone. Therefore, we recommend that you upgrade ExternalDNS in a period of inactivity.

1. Go to your GitOps repository, inside your rok-tools management environment:

   

   root@rok-tools:~# cd ~/ops/deployments

2. Specify the selected DNS name suffix (domain) for your DNS zone:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-zone

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ZONE_DOMAIN

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# export DOMAIN=<DOMAIN>

   Replace <DOMAIN> with your selected domain. For example:

   

   root@rok-tools:~/ops/deployments# export DOMAIN=apps.example.com

   See also

   See the Expose EKF guide for more info about your selected domain and subdomain.

3. Specify the selected subdomain (FQDN) of your Load Balancer:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-acm

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ACM_SUBDOMAIN

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# export FQDN=<FQDN>

   Replace <FQDN> with your selected subdomain. For example:

   

   root@rok-tools:~/ops/deployments# export FQDN=arrikto-cluster.apps.example.com

4. Obtain the ID of your DNS zone:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-zone

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ZONE_ID

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~# export ZONE_NAME=$(gcloud dns managed-zones list \ > --filter dnsName=${DOMAIN?}. \ > | awk 'NR > 1 {print $1}')

5. Scale down ExternalDNS:

   

   root@rok-tools:~/ops/deployments# kubectl scale deploy external-dns --replicas=0 deployment.apps/external-dns scaled

6. Ensure ExternalDNS scaled down to zero. Verify that field READY is 0/0:

   

   root@rok-tools:~/ops/deployments# kubectl get deploy external-dns NAME READY UP-TO-DATE AVAILABLE AGE external-dns 0/0 0 0 1m

7. Retrieve the DNS records that ExternalDNS has created and ensure that there are only two records for your subdomain: one A record and one TXT record:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# aws route53 list-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --query "ResourceRecordSets[?Name =='${EKS_ALB_ACM_SUBDOMAIN?}.']" \ > --output text arrikto-cluster.apps.example.com. A ALIASTARGET k8s-ingressn-ingressn-63143d1fd5-1897405364.eu-central-1.elb.amazonaws.com. True Z215JYRZR1TBD5 arrikto-cluster.apps.example.com. 300 TXT RESOURCERECORDS "heritage=external-dns,external-dns/owner=my-hostedzone-identifier,external-dns/resource=ingress/istio-system/istio-ingress"

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# gcloud dns record-sets list \ > --zone=${ZONE_NAME?} \ > --name=${FQDN?}. NAME TYPE TTL DATA arrikto-cluster.apps.arrikto.com. A 300 35.205.198.62 arrikto-cluster.apps.arrikto.com. TXT 300 "heritage=external-dns,external-dns/owner=my-hostedzone-identifier,external-dns/resource=ingress/istio-system/istio-ingress"

8. Delete the DNS records that ExternalDNS has created:

   AWS

   Azure

   Google Cloud

   1. Store the record sets to environment variables:

      

      root@rok-tools:~/ops/deployments# export ALIAS_RESOURCE_RECORD_SET=\ > $(aws route53 list-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --query "ResourceRecordSets[?Name =='${EKS_ALB_ACM_SUBDOMAIN?}.' && Type == 'A'] \ > | [0]")
      

      root@rok-tools:~/ops/deployments# export TXT_RESOURCE_RECORD_SET=\ > $(aws route53 list-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --query "ResourceRecordSets[?Name =='${EKS_ALB_ACM_SUBDOMAIN?}.' && Type == 'TXT'] \ > | [0]")

   2. Create the configuration file for deleting the DNS records:

      

      root@rok-tools:~/ops/deployments# j2 rok/eks/edns-delete-records.json.j2 \ > -o /tmp/edns-delete-records.json

   3. Delete the DNS records:

      

      root@rok-tools:~/ops/deployments# aws route53 change-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --change-batch file:///tmp/edns-delete-records.json { "ChangeInfo": { "Id": "/change/C0551258C0ZEY43C3WI6", "Status": "PENDING", "SubmittedAt": "2021-07-08T08:06:02.070000+00:00" } }

   4. Delete the DNS temporary configuration file:

      

      root@rok-tools:~/ops/deployments# rm /tmp/edns-delete-records.json

   We do not support deploying ExternalDNS on Azure.

   1. Delete the A DNS record:

      

      root@rok-tools:~/ops/deployments# gcloud dns record-sets delete ${FQDN?}. \ > --zone=${ZONE_NAME?} \ > --type=A Deleted [https://dns.googleapis.com/dns/v1/projects/arrikto-playground/managedZones/arrikto-apps/rrsets/arrikto-cluster.apps.arrikto.com./A].

   2. Delete the TXT DNS record:

      

      root@rok-tools:~/ops/deployments# gcloud dns record-sets delete ${FQDN?}. \ > --zone=${ZONE_NAME?} \ > --type=TXT Deleted [https://dns.googleapis.com/dns/v1/projects/arrikto-playground/managedZones/arrikto-apps/rrsets/arrikto-cluster.apps.arrikto.com./TXT].

9. Wait until the DNS records get deleted:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# watch "aws route53 list-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --query \"ResourceRecordSets[?Name =='${EKS_ALB_ACM_SUBDOMAIN?}.']\" \ > --output text" arrikto-cluster.apps.example.com. A ALIASTARGET k8s-ingressn-ingressn-63143d1fd5-1897405364.eu-central-1.elb.amazonaws.com. True Z215JYRZR1TBD5 arrikto-cluster.apps.example.com. 300 TXT RESOURCERECORDS "heritage=external-dns,external-dns/owner=my-hostedzone-identifier,external-dns/resource=ingress/istio-system/istio-ingress"

   Note

   The output of this command will change until all records are deleted. Press Ctrl+C to exit when the output is empty.

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# watch gcloud dns record-sets list \ > --zone=${ZONE_NAME?} \ > --name=${FQDN?}. NAME TYPE TTL DATA arrikto-cluster.apps.arrikto.com. A 300 35.205.198.62 arrikto-cluster.apps.arrikto.com. TXT 300 "heritage=external-dns,external-dns/owner=my-hostedzone-identifier,external-dns/resource=ingress/istio-system/istio-ingress"

   Note

   The output of this command will change until all records are deleted. Press Ctrl+C to exit when you see the Listed 0 items message.

10. Edit the manifests to specify your cluster name as the owner identifier for the managed DNS records:

    AWS

    Azure

    Google Cloud

    1. Retrieve your cluster name:

       

       root@rok-tools:~/ops/deployments# source <(cat deploy/{env.envvars-aws,\ > env.eks-cluster})
       

       root@rok-tools:~/ops/deployments# export AWS_DEFAULT_REGION EKS_CLUSTER

    2. Define the owner ID for ExternalDNS:

       

       root@rok-tools:~/ops/deployments# export EKS_ALB_EDNS_OWNER=rok-\ > ${AWS_DEFAULT_REGION?}-${EKS_CLUSTER?}

    3. Render the ExternalDNS deployment patch template to set --txt-owner-id to the owner ID:

       

       root@rok-tools:~/ops/deployments# j2 \ > rok/external-dns/overlays/deploy/patches/deploy.yaml.j2 \ > -o rok/external-dns/overlays/deploy/patches/deploy.yaml

    We do not support deploying ExternalDNS on Azure.

    1. Specify your zone:

       

       root@rok-tools:~/ops/deployments# export ZONE=<MY_ZONE>

       Replace <MY_ZONE> with your selected zone. For example:

       

       root@rok-tools:~/ops/deployments# export ZONE=us-east1-b

    2. Specify your cluster name:

       

       root@rok-tools:~/ops/deployments# export GKE_CLUSTER=<MY_CLUSTER>

       Replace <MY_CLUSTER> with your selected cluster name. For example:

       

       root@rok-tools:~/ops/deployments# export GKE_CLUSTER=arrikto-cluster

    3. Define the owner ID for ExternalDNS:

       

       root@rok-tools:~/ops/deployments# export EDNS_OWNER=rok-${ZONE?}-${GKE_CLUSTER?}

    4. Retrieve the owner ID for ExternalDNS you defined in the previous step. Copy the output to your clipboard, as you are going to use this value in the next step:

       

       root@rok-tools:~/ops/deployments# echo ${EDNS_OWNER?} rok-us-east1-b-arrikto-cluster

    5. Edit the rok/external-dns/overlays/deploy/patches/deploy-gcp.yaml and set --txt-owner-id to the owner ID.

       

       ... - --txt-owner-id=rok-us-east1-b-arrikto-cluster # <-- Update this line with your EDNS_OWNER

11. Edit the manifests to enable full synchronization for the DNS records:

    AWS

    Azure

    Google Cloud

    Skip to the next step.

    We do not support deploying ExternalDNS on Azure.

    Edit the rok/external-dns/overlays/deploy/patches/deploy-gcp.yaml and set --policy to sync.

    

    ... - --policy=sync # <-- Set this option to sync

12. Commit your changes:

    

    root@rok-tools:~/ops/deployments# git commit -am "Configure owner ID in ExternalDNS"

13. Apply the new manifests for ExternalDNS:

    

    root@rok-tools:~/ops/deployments# rok-deploy --apply \ > rok/external-dns/overlays/deploy

14. Scale ExternalDNS back up:

    

    root@rok-tools:~/ops/deployments# kubectl scale deploy external-dns --replicas=1 deployment.apps/external-dns scaled

Verify

1. Go to your GitOps repository, inside your rok-tools management environment:

   

   root@rok-tools:~# cd ~/ops/deployments

2. Verify that the ExternalDNS is up-and-running. Check that field READY is 1/1 for the corresponding resources:

   

   root@rok-tools:~/ops/deployments# kubectl get deploy external-dns NAME READY UP-TO-DATE AVAILABLE AGE external-dns 1/1 1 1 1m

3. Specify the selected DNS name suffix (domain) for your DNS zone:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-zone

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ZONE_DOMAIN

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# export DOMAIN=<DOMAIN>

   Replace <DOMAIN> with your selected domain. For example:

   

   root@rok-tools:~/ops/deployments# export DOMAIN=apps.example.com

   See also

   See the Expose EKF guide for more info about your selected domain and subdomain.

4. Specify the selected subdomain (FQDN) of your Load Balancer:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-acm

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ACM_SUBDOMAIN

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# export FQDN=<FQDN>

   Replace <FQDN> with your selected subdomain. For example:

   

   root@rok-tools:~/ops/deployments# export FQDN=arrikto-cluster.apps.example.com

5. Obtain the ID of your DNS zone:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# source deploy/env.eks-alb-zone

   

   root@rok-tools:~/ops/deployments# export EKS_ALB_ZONE_ID

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~# export ZONE_NAME=$(gcloud dns managed-zones list \ > --filter dnsName=${DOMAIN?}. \ > | awk 'NR > 1 {print $1}')

6. Verify that ExternalDNS created 2 new DNS records for your subdomain. Verify that the TXT record contains your cluster name in the owner field:

   AWS

   Azure

   Google Cloud

   

   root@rok-tools:~/ops/deployments# aws route53 list-resource-record-sets \ > --hosted-zone-id ${EKS_ALB_ZONE_ID?} \ > --query "ResourceRecordSets[?Name =='${EKS_ALB_ACM_SUBDOMAIN?}.']" \ > --output text arrikto-cluster.apps.example.com. A ALIASTARGET k8s-ingressn-ingressn-63143d1fd5-1897405364.eu-central-1.elb.amazonaws.com. True Z215JYRZR1TBD5 arrikto-cluster.apps.example.com. 300 TXT RESOURCERECORDS "heritage=external-dns,external-dns/owner=rok-us-west-2-arrikto-cluster,external-dns/resource=ingress/istio-system/istio-ingress"

   We do not support deploying ExternalDNS on Azure.

   

   root@rok-tools:~/ops/deployments# gcloud dns record-sets list \ > --zone=${ZONE_NAME?} \ > --name=${FQDN?}. NAME TYPE TTL DATA arrikto-cluster.apps.arrikto.com. A 300 35.205.198.62 arrikto-cluster.apps.arrikto.com. TXT 300 "heritage=external-dns,external-dns/owner=rok-us-east1-b-arrikto-cluster,external-dns/resource=ingress/istio-system/istio-ingress"

Summary

You have successfully upgraded ExternalDNS.

What’s Next

The next step is to test your upgraded deployment.

• Test Upgrade