WIP Revert " fix(azure): prevent externalDNSDomain from shadowing cluster apps domain"

api/hypershift/v1beta1/hostedcluster_types.go

@@ -527,7 +527,6 @@ type Capabilities struct {
 // +kubebuilder:validation:XValidation:rule=`!self.services.exists(s, s.service == 'APIServer' && has(s.servicePublishingStrategy.loadBalancer) && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration) && has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts) && has(self.configuration.apiServer.servingCerts.namedCertificates) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert, has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))`, message="APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]"
 // +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'"
 // +kubebuilder:validation:XValidation:rule="self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)", message="ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes"
-// +kubebuilder:validation:XValidation:rule=`self.platform.type != "Azure" || self.dns.baseDomain == "" || !self.services.exists(s, (has(s.servicePublishingStrategy.route) && has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.') && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.') + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname) && s.servicePublishingStrategy.loadBalancer.hostname.contains('.') && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.') + 1))))`,message="Azure service hostname domain must not overlap with the cluster base domain. An Azure Private DNS zone matching or containing the base domain would shadow *.apps DNS resolution."
 type HostedClusterSpec struct {
 	// release specifies the desired OCP release payload for all the hosted cluster components.
 	// This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml

@@ -6533,17 +6533,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml

@@ -6516,17 +6516,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml

@@ -6536,17 +6536,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml

@@ -6848,17 +6848,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml

@@ -6988,17 +6988,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml

@@ -6979,17 +6979,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml

@@ -6962,17 +6962,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml

@@ -6581,17 +6581,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HyperShiftOnlyDynamicResourceAllocation.yaml

@@ -6538,17 +6538,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties:

api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ImageStreamImportMode.yaml

@@ -6534,17 +6534,6 @@ spec:
             - message: ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes
               rule: self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration)
                 || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)
-            - message: Azure service hostname domain must not overlap with the cluster
-                base domain. An Azure Private DNS zone matching or containing the
-                base domain would shadow *.apps DNS resolution.
-              rule: self.platform.type != "Azure" || self.dns.baseDomain == "" ||
-                !self.services.exists(s, (has(s.servicePublishingStrategy.route) &&
-                has(s.servicePublishingStrategy.route.hostname) && s.servicePublishingStrategy.route.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.route.hostname.substring(s.servicePublishingStrategy.route.hostname.indexOf('.')
-                + 1))) || (has(s.servicePublishingStrategy.loadBalancer) && has(s.servicePublishingStrategy.loadBalancer.hostname)
-                && s.servicePublishingStrategy.loadBalancer.hostname.contains('.')
-                && ('.' + self.dns.baseDomain).endsWith('.' + s.servicePublishingStrategy.loadBalancer.hostname.substring(s.servicePublishingStrategy.loadBalancer.hostname.indexOf('.')
-                + 1))))
           status:
             description: status is the latest observed status of the HostedCluster.
             properties: