Repository navigation
An HTTPProxy reports success while one hostname's DNS record is refused #537
Description
Summary
An HTTPProxy reports HostnamesVerified=True, "All hostnames have been accepted and programmed", while the DNS record for one of its hostnames was refused. That hostname's own status says DNSRecordProgrammed=False.
Our API documentation promises that a hostname which is not programmed is named in that message, with the reason.
Evidence
The condition is decided from the downstream Gateway's listener Accepted conditions and nothing else, so "programmed" means the listener was accepted. The deprecated status.hostnames list comes from the same set.
The DNS result is built after the condition is written and goes only into the per-hostname statuses. A refused record gives the hostname DNSRecordProgrammed=False with the refusal.
To reproduce, use a zone whose Domain is an apex, so the proxy writes ALIAS records. Create a CNAME record set at one name, and attach that name and one other to an HTTPProxy. PowerDNS refuses the proxy's ALIAS beside the CNAME.
datumctl get httpproxy <name> --project <project> -n <namespace> -o json \
| jq '{verified: [.status.conditions[] | select(.type == "HostnamesVerified") | {status, message}],
dns: [.status.hostnameStatuses[] | {hostname, dns: [.conditions[] | select(.type == "DNSRecordProgrammed") | .status]}]}'verified reads True and names no hostname. The refused hostname's entry reads False.
Acceptance criteria
- An HTTPProxy with a hostname whose DNS record is not programmed reports
HostnamesVerifiedother thanTrue. - The condition message names that hostname and why its DNS record is not programmed.
- An HTTPProxy whose DNS records are all programmed still reports
HostnamesVerified=True.
Related
- Generated hostnames never report that their DNS record is programmed #458 is a generated hostname with no DNS condition at all. A fix here must not mark it as failed.
- Load balancer hostnames never say why their DNS record wasn't created #489 is a hostname whose record is never created, so it has no DNS status.
- Once the webhook refuses a
CNAMEbeside another type (dns-operatordb3011b), this setup gives the Load balancer hostnames never say why their DNS record wasn't created #489 case instead. The condition reads only the listeners, so it would still sayTrue.
Activity
vvoytovych commentedon Oct 19, 2026
Fixed in v0.32.30 by #657, which production has run since 2026-10-18.
What an HTTPProxy shows now:
DNSRecordsProgrammed, as its Gateway does. A refused or conflicting DNS record reads False with reasonPartialFailure, and the hostname's own status says why.Pending, not as a failure.HostnamesVerifiedkeeps its meaning: whether each hostname is owned and accepted. So this took a different route than the criteria above name. DNS has a condition of its own.On production, before and after the roll:
DNSRecordsProgrammedFalseDNSRecordsProgrammedThe 8 Gateways that stay False each have a hostname whose record was refused or that waits on the customer. A wait on Datum would read
Pending. The other 15 had no hostname left for Datum-managed DNS and dropped a condition left from an earlier state.The API documentation and the True message that this issue quoted are corrected in #665.
#650 first carried the condition and was reverted by #655, because a new hostname showed a false failure while its zone settled. #657 carries it again and reports that wait as pending.