// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-deploy/hcp-deploy-aws.adoc

:_mod-docs-content-type: CONCEPT
[id="hcp-aws-enable-ext-dns_{context}"]
= Enabling external DNS for {hcp} on {aws-short}

[role="_abstract"]
To automate the management of DNS records, you can enable external DNS. By configuring this feature, you provide a way for the cluster to update your {aws-short} Route 53 public hosted zones automatically when you create or delete services and ingresses.

The control plane and the data plane are separate in {hcp}. You can configure DNS in two independent areas:

* Ingress for workloads within the hosted cluster, such as the following domain: `*.apps.service-consumer-domain.com`.

* Ingress for service endpoints within the management cluster, such as API or OAuth endpoints through the service provider domain: `*.service-provider-domain.com`.

The input for `hostedCluster.spec.dns` manages the ingress for workloads within the hosted cluster. The input for `hostedCluster.spec.services.servicePublishingStrategy.route.hostname` manages the ingress for service endpoints within the management cluster.

External DNS creates name records for hosted cluster services that specify a publishing type of `LoadBalancer` or `Route` and provide a hostname for that publishing type. For hosted clusters with `Private` or `PublicAndPrivate` endpoint access types, only the `APIServer` and `OAuth` services support hostnames. For `Private` hosted clusters, the DNS record resolves to a private IP address of a Virtual Private Cloud (VPC) endpoint in your VPC.

A hosted control plane exposes the following services:

* `APIServer`
* `OIDC`

[NOTE]
====
The `NodePort` publishing type is not supported on {hcp} on {aws-short}.
====

You can expose these services by using the `servicePublishingStrategy` field in the `HostedCluster` specification. By default, for the `LoadBalancer` and `Route` types of `servicePublishingStrategy`, you can publish the service in one of the following ways:

* By using the hostname of the load balancer that is in the status of the `Service` with the `LoadBalancer` type.
* By using the `status.host` field of the `Route` resource.

However, when you deploy {hcp} in a managed service context, those methods can expose the ingress subdomain of the underlying management cluster and limit options for the management cluster lifecycle and disaster recovery.

When a DNS indirection is layered on the `LoadBalancer` and `Route` publishing types, a managed service operator can publish all public hosted cluster services by using a service-level domain. This architecture allows remapping on the DNS name to a new `LoadBalancer` or `Route` and does not expose the ingress domain of the management cluster. {hcp-capital} uses external DNS to achieve that indirection layer.

You can deploy `external-dns` alongside the HyperShift Operator in the `hypershift` namespace of the management cluster. External DNS watches for `Services` or `Routes` that have the `external-dns.alpha.kubernetes.io/hostname` annotation. That annotation is used to create a DNS record that points to the `Service`, such as an A record, or the `Route`, such as a CNAME record.

You can use external DNS on cloud environments only. For the other environments, you need to manually configure DNS and services.

For more information about external DNS, see link:https://github.com/kubernetes-sigs/external-dns[external DNS].
