// Module included in the following assemblies:
//
// * networking/external_dns_operator/nw-creating-dns-records-on-azure.adoc

:_mod-docs-content-type: PROCEDURE
[id="nw-control-dns-records-public-hosted-zone-azure_{context}"]
= Creating DNS records on an Azure DNS zone

[role="_abstract"]
To create DNS records on a public or private DNS zone for Azure, use the External DNS Operator. The Operator manages external name resolution for your cluster.

.Prerequisites

* You must have administrator privileges.
* The `admin` user must have access to the `kube-system` namespace.

.Procedure

. Fetch the credentials from the `kube-system` namespace to use the cloud provider client by running the following command:
+
[source,terminal]
----
$ CLIENT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_id}} | base64 -d)
----
+
[source,terminal]
----
$ CLIENT_SECRET=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_client_secret}} | base64 -d)
----
+
[source,terminal]
----
$ RESOURCE_GROUP=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_resourcegroup}} | base64 -d)
----
+
[source,terminal]
----
$ SUBSCRIPTION_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_subscription_id}} | base64 -d)
----
+
[source,terminal]
----
$ TENANT_ID=$(oc get secrets azure-credentials  -n kube-system  --template={{.data.azure_tenant_id}} | base64 -d)
----

. Log in to Azure by running the following command:
+
[source,terminal]
----
$ az login --service-principal -u "${CLIENT_ID}" -p "${CLIENT_SECRET}" --tenant "${TENANT_ID}"
----

. Get a list of routes by running the following command:
+
[source,terminal]
----
$ oc get routes --all-namespaces | grep console
----
+
.Example output
[source,terminal]
----
openshift-console          console             console-openshift-console.apps.test.azure.example.com                       console             https   reencrypt/Redirect     None
openshift-console          downloads           downloads-openshift-console.apps.test.azure.example.com                     downloads           http    edge/Redirect          None
----

. Get a list of DNS zones.
+
.. For public DNS zones, enter the following command:
+
[source,terminal]
----
$ az network dns zone list --resource-group "${RESOURCE_GROUP}"
----
+
.. For private DNS zones, enter the following command:
+
[source,terminal]
----
$ az network private-dns zone list -g "${RESOURCE_GROUP}"
----

. Create a YAML file, for example, `external-dns-sample-azure.yaml`, that defines the `ExternalDNS` object:
+
.Example `external-dns-sample-azure.yaml` file
[source,yaml]
----
apiVersion: externaldns.olm.openshift.io/v1beta1
kind: ExternalDNS
metadata:
  name: sample-azure
spec:
  zones:
  - "/subscriptions/1234567890/resourceGroups/test-azure-xxxxx-rg/providers/Microsoft.Network/dnszones/test.azure.example.com"
  provider:
    type: Azure
  source:
    openshiftRouteOptions:
      routerName: default
    type: OpenShiftRoute
# ...
----
+
where:
+
`metadata.name`:: Specifies the External DNS name.
`spec.zones`:: Specifies the zone ID. For a private DNS zone, change `dnszones` to `privateDnsZones`.
`provider.type`:: Specifies the provider type.
`source.openshiftRouteOptions`:: Specifies the options for the source of DNS records.
`routerName`:: If the source type is `OpenShiftRoute`, you can pass the OpenShift Ingress Controller name. The External DNS Operator selects the canonical hostname of that router as the target while creating the CNAME record.
`source.type`:: Specifies the `route` resource as the source for the Azure DNS records.

.Troubleshooting

. Check the records created for the routes.
+
.. For public DNS zones, enter the following command:
+
[source,terminal]
----
$ az network dns record-set list -g "${RESOURCE_GROUP}" -z "${ZONE_NAME}" | grep console
----
+
.. For private DNS zones, enter the following command:
+
[source,terminal]
----
$ az network private-dns record-set list -g "${RESOURCE_GROUP}" -z "${ZONE_NAME}" | grep console
----
