Apex domain to point to an Openshift ROSA application

  • We have a ROSA (Openshift on AWS) cluster, working fine with all kinds of domains except one, which happens to be an apex of the Hosting Zone in our Route53. So, say, the domain is example.com and it's registered in AWS with the name servers - all well. I have created a CustomDomain in the Openshift cluster that works for all it's subdomains eg. www.example.com. This is thanks to a wildcard CNAME record that points all *.example.com queries to zhfsrc.example-com.test.plvo.p1.openshiftapps.com provided by the CustomDomain object:

    apiVersion: managed.openshift.io/v1alpha1
    kind: CustomDomain

    name: example-com

    name: example-com-tls
    namespace: example
    domain: example.com
    scope: External
    - lastProbeTime: '2022-04-13T16:11:33Z'
    lastTransitionTime: '2022-04-13T16:11:33Z'
    message: Custom Apps Domain (example.com) Is Ready
    reason: Ready
    status: 'True'
    type: Ready
    dnsRecord: '*.example-com.test.plvo.p1.openshiftapps.com.'
    endpoint: zhfsrc.example-com.test.plvo.p1.openshiftapps.com
    scope: ''
    state: Ready

    Now, I am missing the A record and this breaks the deal. Restrictions found:

    • the apex domain cannot be a CNAME
    • the A record in Route53 cannot point to a CNAME
    • there is (apparently) no resource the A record can be an alias for (tried the openshift LBs)
    • CNAME flattening is not available in Route53

    I see this as a most basic use case - a domain registered via AWS pointing to an Openshift application, yet neither RH nor AWS support were able to help so far.

  • The AWS support finally helped, it was kind of blurry between RH and Route53. So, the trick is to find your endpoint in the Hosting Zone managed by Openshift, in our case:


    Note the Elastic Load Balancer it's pointing to (the "Value/Route traffic to" column). Then go back to the Hosting Zone in question and add an A record as an alias to the same ELB in its respective region.

    • record name: example.com
    • record type: A
    • route traffic to: [x] Alias
    • Alias to Application and Classic Load Balancer
    • [region of your ROSA cluster]
    • [dualstack.the-ID-of-your-ELB.elb.amazonaws.com.]

    After 60 secs it's already propagated.

    thanks AWS!

Suggested Topics

  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2