// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc

:_mod-docs-content-type: PROCEDURE
[id="hcp-aws-create-dns-hosted-zone_{context}"]
= Creating the public DNS hosted zone

[role="_abstract"]
You can create the public DNS hosted zone to use as the external DNS domain filter. The External DNS Operator uses the public DNS hosted zone to create your public hosted cluster. 

.Procedure

. In the {aws-short} Route 53 management console, click *Create hosted zone*.

. On the *Hosted zone configuration* page, type a domain name, verify that *Public hosted zone* is selected as the type, and click *Create hosted zone*.

. After the zone is created, on the *Records* tab, note the values in the *Value/Route traffic to* column.

. In the main domain, create an NS record to redirect the DNS requests to the delegated zone. In the *Value* field, enter the values that you noted in the previous step.

. Click *Create records*.

. Verify that the DNS hosted zone is working by creating a test entry in the new subzone and testing it with a `dig` command, such as in the following example:
+
[source,terminal]
----
$ dig +short test.user-dest-public.aws.kerberos.com
----
+
.Example output
[source,terminal]
----
192.168.1.1
----

. To create a hosted cluster that sets the hostname for the `LoadBalancer` and `Route` services, enter the following command:
+
[source,terminal]
----
$ hcp create cluster aws --name=<hosted_cluster_name> \
  --endpoint-access=PublicAndPrivate \
  --external-dns-domain=<public_hosted_zone> ...
----
+
Replace `<public_hosted_zone>` with the public hosted zone that you created.
+
.Example `services` block for the hosted cluster
[source,yaml]
----
  platform:
    aws:
      endpointAccess: PublicAndPrivate
...
  services:
  - service: APIServer
    servicePublishingStrategy:
      route:
        hostname: api-example.service-provider-domain.com
      type: Route
  - service: OAuthServer
    servicePublishingStrategy:
      route:
        hostname: oauth-example.service-provider-domain.com
      type: Route
  - service: Konnectivity
    servicePublishingStrategy:
      type: Route
  - service: Ignition
    servicePublishingStrategy:
      type: Route
----
+
The Control Plane Operator creates the `Services` and `Routes` resources and annotates them with the `external-dns.alpha.kubernetes.io/hostname` annotation. For `Services` and `Routes`, the Control Plane Operator uses a value of the `hostname` parameter in the `servicePublishingStrategy` field for the service endpoints. To create the DNS records, you can use a mechanism, such as the `external-dns` deployment.
+
You can configure service-level DNS indirection for public services only. You cannot set `hostname` for private services because they use the `hypershift.local` private zone.
+
The following table shows when it is valid to set `hostname` for a service and endpoint combinations:
+
.Service and endpoint combinations to set `hostname`
[cols="4,1,1,1",options="header"]
|===
|Service |Public |PublicAndPrivate |Private

|`APIServer`
|Y
|Y
|N

|`OAuthServer`
|Y
|Y
|N

|`Konnectivity`
|Y
|N
|N

|`Ignition`
|Y
|N
|N
|===
