DNS lookup error while using Azure Managed Identity with v0.10.0

[zerodayyy]

What happened:

While using external-dns with Azure Managed Identity, the following error is seen:

time="2021-10-17T18:02:57Z" level=error msg="azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://management.azure.com/subscriptions/********-****-****-****-************/resourceGroups/redacted/providers/Microsoft.Network/privateDnsZones?api-version=2018-09-01: StatusCode=0 -- Original Error: adal: Failed to execute the refresh request. Error = 'Post \"http://dummy\": dial tcp: lookup dummy on 10.0.0.10:53: no such host'"

Which coincides with this commit: ab0cdd0 where this fragment in provider/azure/config.go L107:

os.Setenv("MSI_ENDPOINT", "http://dummy")

hard-codes some test value, preventing external-dns from using the actual MSI endpoint, and leading to DNS lookup error.

What you expected to happen:

external-dns makes a request to MSI endpoint successfully

How to reproduce it (as minimally and precisely as possible):

Run external-dns with azure provider and set "useManagedIdentityExtension": true in config.

Anything else we need to know?:

Environment: Kubernetes v1.21.2

• External-DNS version (use external-dns --version): v0.10.0
• DNS provider: azure

[mrsimonemms]

I've had this same issue as well with the Bitnami Helm chart. Reverting to version 5.4.8 (and thence the external-dns 0.9.0) solved the issue as well.

For clarity (and future people), my config is:

{
  "tenantId": "xxx",
  "subscriptionId": "xxx",
  "resourceGroup": "xxx",
  "useManagedIdentityExtension": true,
  "userAssignedIdentityID": "xxx"
}

The userAssignedIdentityID comes from az aks show -n xxx -g xxx --query "identityProfile.kubeletidentity.clientId" -o tsv

[beastob]

I've had this same issue as well with the Bitnami Helm chart. Reverting to version 5.4.8 (and thence the external-dns 0.9.0) solved the issue as well.

For clarity (and future people), my config is:

{
  "tenantId": "xxx",
  "subscriptionId": "xxx",
  "resourceGroup": "xxx",
  "useManagedIdentityExtension": true,
  "userAssignedIdentityID": "xxx"
}

The userAssignedIdentityID comes from az aks show -n xxx -g xxx --query "identityProfile.kubeletidentity.clientId" -o tsv

This suggested downgrade worked for me (external-dns chart v1.2.0). However I also tried to upgrade to chart v1.6.0 (app v0.10.1) first but with no luck at all.

[bigfleet]

Downgrade restored service for me as well, using managed service identity on Azure. Verified pod with same labels applied could edit records successfully via az.

[sossickd]

Can this issue be closed looks like the faulty test has been removed in chart version 1.7.0 (image v0.10.2)? Tested chart version 1.7.0 and no longer receiving the error.

external-dns-helm-chart-1.6.0...external-dns-helm-chart-1.7.0

[beastob]

Can this issue be closed looks like the faulty test has been removed in chart version 1.7.0 (image v0.10.2)? Tested chart version 1.7.0 and no longer receiving the error.

external-dns-helm-chart-1.6.0...external-dns-helm-chart-1.7.0

@sossickd Thanks for the info, I believe that MSI_ENDPOINT mis-configuration was the problem. I'll come back with the result after my testing as well.

[mrsimonemms]

@sossickd I've got this working with the latest Helm version (v6.0.2) using the exact same config as was used with v5.4.8 as referenced above

As far as I'm concerned, this issue has been fixed and can be closed

[beastob]

tested with the same result as @sossickd, problem is now fixed in Chart version 1.7.0 (external-dns v0.10.2). by issue #2384

This Issue can be closed.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale