RFE: Multi-tenancy support

[paterczm]

Hello!

I came across this operator looking for an automated solution to manage DNS records in Infoblox using OpenShift native apis. It would fit out use case well if it offered a self-service DNS management for regular users (not cluster admin) in a multi-tenant cluster. In other words, if it allowed tenants to provide DNS credentials (scoped to specific zones they own in Infoblox) as Secrets in their own namespaces, preventing them from fiddling with someone else's zone. Do you think this use case and RFE fits External DNS Operator?

Thanks!

Marek

[alebedev87]

After the discussion on Slack. The ExternalDNS API is intentionally designed to be cluster-scoped, as DNS management is considered a privileged operation. Changing this design would require a significant paradigm shift and a lot of engineering investment, which we may be not feasible at this time.

That said, the ExternalDNS Operator and its API can still be used in a multi-tenant environment - provided that the management of the cluster-scoped ExternalDNS resource and its associated credentials secret is delegated to the cluster administrator.

To support tenant-specific configurations, the label selector can be used to filter Services or Routes for each tenant. Once the cluster-level setup is in place, tenants can begin managing their own source resources. This enables DNS record creation, updates, and deletions to be scoped to individual tenants - even though the core ExternalDNS resource remains cluster-wide.

Note that each ExternalDNS CR results into a dedicated deployment in external-dns-operator namespace. The credentials secret should be from this namespace.