Docs - Google Cross Project Scenario not Covered

[darkn3rd]

What happened: Instructions for google provider will not work if Cloud DNS is in another project.

Instructions:

• https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/gke.md

What you expected to happen: Instructions would have extra instructions for this use case.

How to reproduce it (as minimally and precisely as possible):

1. In google project MYPROJECT_A - register zone + ns in Cloud DNS
2. In google project MYPROJECT_B - create GKE cluster per instructions with the added scope to access modify DNS records
3. Deploy external-dns manifest including - --google-project=MYPROJECT_A
4. Deploy an application with annotation in service for the DNS, e.g. external-dns.alpha.kubernetes.io/hostname: my-hello-kube.mycompany.com

What actually happened:

In the logs:
time="2020-05-23T06:54:54Z" level=error msg="googleapi: Error 403: Forbidden, forbidden"

Anything else we need to know?: This use case is not covered in the documentation, and unlikely that users will be able to figure this out on their own except walking through the code. From what I understand, this will require referencing service account credentials that has DNS admin role. This use case is handled by the helm chart, and documented at http://tech.paulcz.net/kubernetes-cookbook/gcp/gcp-external-dns/. There needs to be equivalent documentation for the manifests.

Environment:

• External-DNS version (use external-dns --version): 0.7.1
• DNS provider: google
• Others:

[Raffo]

Hi @darkn3rd , feel free to open a PR with the documentation, if you want to. We can't foresee all the possible use cases, so we'll gladly get as many documentations PRs as possible.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[seanmalloy]

/remove-lifecycle stale
/kind documentation
/remove-kind bug

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[seanmalloy]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[seanmalloy]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[darkn3rd]

/reopen
/remove-lifecycle rotten

[k8s-ci-robot]

@darkn3rd: Reopened this issue.

In response to this:

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[darkn3rd]

The current docs around google provider document a highly unlikely scenario, even for test environments (as it doesn't reflect any real world scenario, at least in my experience):

• using a single project for both CloudDNS and GKE
• adding a scope to read/write all CloudDNS zones within the same project