feat: add annotation and label filters to Ambassador Host Source

[KyleMartin901]

This change makes the Ambassador Host source respect the External-DNS annotation-filter and label-filter allowing for an Ambassador Host resource to specify what External-DNS deployment to use when there are multiple External-DNS deployments within the same cluster. Before this change if you had two External-DNS deployments within the cluster and used the Ambassador Host source the first External-DNS to process the resource will create the record and not the one that was specified in the filter annotation.

Annotation Fillter

I added the filterByAnnotations function so that it matched the same way the other sources have implemented annotation filtering. I didn't add the controller check only because I wanted to keep this change to implementing the annotationFilter.

I added Endpoint tests to validate that the filterByAnnotations function works as expected. Again these tests were based of the Endpoint tests that other sources use. To keep the tests simpler I only allow for a single load balancer to be used.

Example: Create two External-DNS deployments 1 public and 1 private and set the Ambassador Host to use the public External-DNS using the annotation filter.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns-private
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: external-dns-private
  template:
    metadata:
      labels:
        app: external-dns-private
      annotations:
        iam.amazonaws.com/role: {ARN} # AWS ARN role
    spec:
      serviceAccountName: external-dns
      containers:
      - name: external-dns
        image: k8s.gcr.io/external-dns/external-dns:latest
        args:
        - --source=ambassador-host
        - --domain-filter=example.net # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
        - --provider=aws
        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
        - --aws-zone-type=private # only look at public hosted zones (valid values are public, private or no value for both)
        - --registry=txt
        - --txt-owner-id= {Hosted Zone ID} # Insert Route53 Hosted Zone ID here
        - --annotation-filter=kubernetes.io/ingress.class in (private)
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: external-dns-public
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: external-dns-public
  template:
    metadata:
      labels:
        app: external-dns-public
      annotations:
        iam.amazonaws.com/role: {ARN} # AWS ARN role
    spec:
      serviceAccountName: external-dns
      containers:
      - name: external-dns
        image: k8s.gcr.io/external-dns/external-dns:latest
        args:
        - --source=ambassador-host
        - --domain-filter=example.net # will make ExternalDNS see only the hosted zones matching provided domain, omit to process all available hosted zones
        - --provider=aws
        - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization
        - --aws-zone-type= # only look at public hosted zones (valid values are public, private or no value for both)
        - --registry=txt
        - --txt-owner-id= {Hosted Zone ID} # Insert Route53 Hosted Zone ID here
        - --annotation-filter=kubernetes.io/ingress.class in (public)
---
apiVersion: getambassador.io/v3alpha1
  kind: Host
  metadata:
    name: your-hostname
    annotations:
      external-dns.ambassador-service: emissary-ingress/emissary
      kubernetes.io/ingress.class: public
  spec:
		acmeProvider:
      authority: none
		hostname: your-hostname.example.com

Fixes #2632

Label Filter

Currently, the --label-filter flag can only be used to filter CRDs, Ingress, Service and Openshift Route objects that match the label selector passed through that flag. This change extends the functionality to the Ambassador Host type object.

When the flag is not specified the default value is labels.Everything() which is an empty string, the same as before.
Annotation based filter is inefficient because the filtering has to be done in the controller instead of the API server like with label filtering. The Annotation based filtering has been left in for legacy reasons so the Ambassador Host source can be used in conjunction with the other sources that don't yet support label filtering.

It is possible to use label based filtering with annotation based filtering so you can initially filter by label and then filter the returned hosts by annotation. This is not recommended

Fixes #2761

Checklist

• Unit tests updated
• End user documentation updated

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: KyleMartin901 / name: Kyle (f0f718a, b0a39a4, c5137b0)

[k8s-ci-robot]

Welcome @KyleMartin901!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[KyleMartin901]

I have also added the label filter to the Ambassador host source as per suggestion by @alebedev87 in #2043 (comment)

[alebedev87]

Overall LGTM, just some cosmetic comments.

[alebedev87]

Suggested change

	return nil, errors.Wrap(err, "failed to filter Ambassador Hosts")
	return nil, errors.Wrap(err, "failed to filter Ambassador Hosts by annotation")

[alebedev87]

Suggested change

	title: "no host",
	targetNamespace: "",
	labelSelector: labels.Everything(),
	title: "no host",
	labelSelector: labels.Everything(),

Just to safe 1 line from each test case which doesn't need the target namespace.

BTW I didn't see any test case using the targetNamespace, specifying it is supposed to filter hosts too.

[KyleMartin901]

Sorry forgot to add the test case in. I was going to test to make sure the Ambassador host was only added if it is within the External DNS targeted namespace like the following sources do

• Service
• Istio Gateway
• Ingress
• Contour HTTPProxy

[KyleMartin901]

I have added the Target Namespace test now 51e3633

[alebedev87]

Thanks for adding the test case for the namespace!

The other tests cases can remove targetNamespace field as it's set to the empty string by default - will save 1 line for each line.

[alebedev87]

Do we need this test case? The one with the filter expression has already tested the parsing into the labelSelector.

[KyleMartin901]

Up to you again copied the test from Contour, Ingress, Istio Gateway and the service tests. Happy to remove it if you would like.

[alebedev87]

Since it doesn't bring any added value, I'd prefer to remove it - smaller is simpler for the further maintenance.

[alebedev87]

Can be removed if not used.

[KyleMartin901]

Cleaned this up 1629661 sorry forgot to go through and make sure was all clean

[alebedev87]

This annotation can be removed as we don't use any annotation filter, just to keep the test to absolute minimum.

[KyleMartin901]

Thanks I have removed the kubernetes.io/ingress.class annotations from the label tests where they weren't being used. I still need to keep the external-dns.ambassador-service annotation as that is how External DNS knows to assign the DNS record to the correct Ambassador Host service/endpoint.

[alebedev87]

This test case seems to be a "superset" of valid matching label filter expression one, so why not keeping only this one?

[KyleMartin901]

I have now removed valid matching label filter expression as you are correct I am already matching valid label within the valid matching label filter expression for single host test.

Sorry I was trying to match tests like what was done within the annotations without really thinking about it.

[alebedev87]

Not a big deal at all but I've seen all the possible ways of creating a slice of ambassador hosts in this PR:

var ambassadorHosts []*ambassador.Host
---
filteredList := []*ambassador.Host{}
---
ambassadorHosts := make([]*ambassador.Host, 0)

:)

[KyleMartin901]

Sorry about that copy and paste issues. Thanks for picking that up for me totally missed it

[KyleMartin901]

I have cleaned this up in 2482ef5 decided to use the short declaration operator

[KyleMartin901]

@alebedev87 thanks for picking up those issues.

I wasn't sure on the process of adding in the changes if it is preferred for the changes to be added in as new commits or squashed so the PR still only had the two commits for adding annotation filter and label filter. I have just added them as seperate commits so it is easy to squash if that's what is preferred. Let me know if you would prefer me to squash them or happy as is.

[alebedev87]

@KyleMartin901: I'm not aware of any strict rules about the commits. However I don't think that the commits made to address the review remarks really need to be upstream.

[szuecs]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: szuecs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [szuecs]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mloiseleur]

@KyleMartin901 This PR has been approved. It means that it just needs a rebase, to pass tests and it will be merged.

[KyleMartin901]

Thanks @mloiseleur i will attempt to get this done this week. Looks like someone got tests merged in before mine so going to refactor to match what has already been merged

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle rotten
• Close this PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[mloiseleur]

/lgtm

[mloiseleur]

/remove-lifecycle rotten