feat: allow cross projects zone access

.github/workflows/devstack.yml

@@ -70,6 +70,16 @@ jobs:
         run: ./stack.sh
         working-directory: ./devstack
 
+      - name: Fix Designate root_helper
+        # root_helper defaults to "sudo designate-rootwrap ..." in designate/conf/base.py.
+        # designate-rootwrap lives in the devstack venv (/opt/stack/data/venv/bin) which
+        # is not in sudo's secure_path -> every rndc addzone fails -> zones PENDING->ERROR.
+        # Insert the absolute path immediately after [DEFAULT] so oslo.config picks it up.
+        run: |
+          sudo sed -i '/^\[DEFAULT\]/a root_helper = sudo /opt/stack/data/venv/bin/designate-rootwrap /etc/designate/rootwrap.conf' \
+            /etc/designate/designate.conf
+        shell: bash
+
       - name: Restart Designate
         run: sudo systemctl restart "devstack@designate-*.service"
 
@@ -79,7 +89,7 @@ jobs:
 
       - name: Wait for zone creation
         run: |
-          while [ "$(openstack zone list -f csv | grep PENDING)" != "" ]; do date; openstack zone list -f value; sleep 1; done
+          while [ "$(openstack zone list -f value | grep PENDING)" != "" ]; do date; openstack zone list -f value; sleep 1; done
 
       - name: Start external-dns-openstack-webhook in background
         run: |
@@ -94,7 +104,7 @@ jobs:
 
       - name: Wait for PENDING
         run: |
-          while [ "$(openstack zone list -f csv | grep PENDING)" != "" ]; do date; openstack zone list -f value; sleep 1; done
+          while [ "$(openstack zone list -f value | grep PENDING)" != "" ]; do date; openstack zone list -f value; sleep 1; done
 
       - name: Show created entries
         run: |
@@ -107,3 +117,39 @@ jobs:
         run: |
           if [ $(openstack recordset list all -f value | grep -c " TXT ") -ne 10 ]; then exit 1; fi
           if [ $(openstack recordset list all -f value | grep -c " A ") -ne 10 ]; then exit 2; fi
+
+      - name: Create cloud_admin project and grant admin access
+        run: |
+          openstack --os-cloud devstack-admin project create cloud_admin
+          openstack --os-cloud devstack-admin role add --project cloud_admin --user admin admin
+        shell: bash
+
+      - name: Add devstack-cloud-admin cloud entry (admin user scoped to cloud_admin project)
+        run: |
+          AUTH_URL=$(python3 -c "import yaml; print(yaml.safe_load(open('/etc/openstack/clouds.yaml'))['clouds']['devstack-admin']['auth']['auth_url'])")
+          ./devstack/tools/update_clouds_yaml.py \
+            --file /etc/openstack/clouds.yaml \
+            --os-cloud devstack-cloud-admin \
+            --os-region-name RegionOne \
+            --os-auth-url "$AUTH_URL" \
+            --os-username admin \
+            --os-password secret \
+            --os-project-name cloud_admin
+        shell: bash
+
+      - name: Start external-dns-openstack-webhook as cloud_admin with --all-projects on port 8889
+        run: |
+          OS_CLOUD=devstack-cloud-admin ./build/bin/external-dns-openstack-webhook --all-projects --domain-filter example.com --webhook-server-address 127.0.0.1:8889 --status-server-address 0.0.0.0:8081 >/tmp/external-dns-openstack-webhook-all-projects.log 2>&1 &
+          for i in $(seq 30); do curl -sf http://127.0.0.1:8889 > /dev/null 2>&1 && break; sleep 1; done
+          curl -sf http://127.0.0.1:8889 > /dev/null || { cat /tmp/external-dns-openstack-webhook-all-projects.log; exit 1; }
+
+      - name: Run external-dns against example.com as cloud_admin project user
+        run: ./build/external-dns --txt-owner-id all-projects-cluster-id --provider webhook --webhook-provider-url http://127.0.0.1:8889 --source fake --log-level=debug --once 2>&1
+        working-directory: ./external-dns
+
+      - name: Show /tmp/external-dns-openstack-webhook-all-projects.log
+        run: cat /tmp/external-dns-openstack-webhook-all-projects.log
+
+      - name: Check all-projects created entries in example.com
+        run: |
+          if [ $(openstack --os-cloud devstack-admin recordset list example.com. --all-projects -f value | grep -c "all-projects-cluster-id") -ne 10 ]; then exit 1; fi

cmd/webhook/main.go

@@ -16,13 +16,19 @@ import (
 )
 
 const (
-	webhookServerAddr = "127.0.0.1:8888"
-	statusServerAddr  = "0.0.0.0:8080"
+	defaultWebhookServerAddr = "127.0.0.1:8888"
+	defaultStatusServerAddr  = "0.0.0.0:8080"
 )
 
 func main() {
 	var domainFilters []string
+	var allProjects bool
+	var webhookServerAddr string
+	var statusServerAddr string
 	pflag.StringArrayVar(&domainFilters, "domain-filter", []string{}, "List of domains to work on (can be specified multiple times)")
+	pflag.BoolVar(&allProjects, "all-projects", false, "Manage all zones and recordsets regardless of the project the service user resides in (requires an admin or appropriately scoped token)")
+	pflag.StringVar(&webhookServerAddr, "webhook-server-address", defaultWebhookServerAddr, "Address to bind the webhook server to")
+	pflag.StringVar(&statusServerAddr, "status-server-address", defaultStatusServerAddr, "Address to bind the status and metrics server to")
 	pflag.Parse()
 
 	log.SetLevel(log.DebugLevel)
@@ -61,7 +67,7 @@ func main() {
 	}()
 
 	epf := endpoint.NewDomainFilter(domainFilters)
-	dp, err := provider.NewDesignateProvider(*epf, false)
+	dp, err := provider.NewDesignateProvider(*epf, allProjects, false)
 	if err != nil {
 		log.Fatalf("NewDesignateProvider: %v", err)
 		metrics.OpenstackConnectionMetric.Set(0)

go.mod

@@ -60,10 +60,10 @@ require (
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.45.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
@@ -82,3 +82,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/gophercloud/gophercloud/v2 => github.com/gophercloud/gophercloud/v2 v2.13.1-0.20260710184116-38dd002333e1

go.sum

@@ -75,8 +75,8 @@ github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/v
 github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gophercloud/gophercloud/v2 v2.13.0 h1:yEyJG+kABd8x2ttTqLsomihU6Kg2YheJSZhvP/QSx+8=
-github.com/gophercloud/gophercloud/v2 v2.13.0/go.mod h1:KZRLVs6gcoy/pEFdkZqFjdYqnS0emMHv66UqdM5lMjU=
+github.com/gophercloud/gophercloud/v2 v2.13.1-0.20260710184116-38dd002333e1 h1:s/gvhS9oljFYo2wcRt3GpfqGajIgy/LK0wYvT1pgePs=
+github.com/gophercloud/gophercloud/v2 v2.13.1-0.20260710184116-38dd002333e1/go.mod h1:C3sHSVYzyq4F9/488AagHAxTOaYezV0iFojBM0tNq7U=
 github.com/gophercloud/utils/v2 v2.0.0-20260424064311-2eeed4ceb3e9 h1:WEPhYFzYmpfWHq+YPaP3+8pYf4wKQuJMkgPiiI4g7CY=
 github.com/gophercloud/utils/v2 v2.0.0-20260424064311-2eeed4ceb3e9/go.mod h1:bIEH+wgvnxfegUewFuGi0u/L+ji5uiEuVVQMNKQASEY=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -157,14 +157,14 @@ golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=

internal/designate/client/client.go

@@ -57,15 +57,16 @@ type DesignateClientInterface interface {
 // implementation of the DesignateClientInterface
 type designateClient struct {
 	serviceClient *gophercloud.ServiceClient
+	allProjects   bool
 }
 
 // factory function for the DesignateClientInterface
-func NewDesignateClient() (DesignateClientInterface, error) {
+func NewDesignateClient(allProjects bool) (DesignateClientInterface, error) {
 	serviceClient, err := createDesignateServiceClient()
 	if err != nil {
 		return nil, err
 	}
-	return &designateClient{serviceClient}, nil
+	return &designateClient{serviceClient: serviceClient, allProjects: allProjects}, nil
 }
 
 // authenticate in OpenStack and obtain Designate service endpoint
@@ -136,10 +137,10 @@ func (c designateClient) ForEachZone(ctx context.Context, filters []string, hand
 
 	var err error
 	if len(filters) == 0 {
-		err = doList(zones.ListOpts{})
+		err = doList(zones.ListOpts{AllProjects: c.allProjects})
 	} else {
 		for _, f := range filters {
-			if err = doList(zones.ListOpts{Name: f + "."}); err != nil {
+			if err = doList(zones.ListOpts{Name: f + ".", AllProjects: c.allProjects}); err != nil {
 				break
 			}
 		}
@@ -162,7 +163,7 @@ func (c designateClient) ForEachZone(ctx context.Context, filters []string, hand
 func (c designateClient) ForEachRecordSet(ctx context.Context, zoneID string, handler func(recordSet *recordsets.RecordSet) error) error {
 	startTime := time.Now()
 
-	pager := recordsets.ListByZone(c.serviceClient, zoneID, recordsets.ListOpts{})
+	pager := recordsets.ListByZone(c.serviceClient, zoneID, recordsets.ListOpts{AllProjects: c.allProjects})
 	var pageCount int
 	var recordCount int
 
@@ -209,6 +210,7 @@ func (c designateClient) CreateRecordSet(ctx context.Context, zoneID string, opt
 
 	log.Debugf("→ Creating recordset: %s (%s) with %d targets", opts.Name, opts.Type, len(opts.Records))
 
+	opts.AllProjects = c.allProjects
 	r, err := recordsets.Create(ctx, c.serviceClient, zoneID, opts).Extract()
 
 	duration := time.Since(startTime)
@@ -235,6 +237,7 @@ func (c designateClient) UpdateRecordSet(ctx context.Context, zoneID, recordSetI
 	}
 	log.Debugf("→ Updating recordset: %s with %d targets", recordSetID, recordCount)
 
+	opts.AllProjects = c.allProjects
 	_, err := recordsets.Update(ctx, c.serviceClient, zoneID, recordSetID, opts).Extract()
 
 	duration := time.Since(startTime)
@@ -257,7 +260,7 @@ func (c designateClient) DeleteRecordSet(ctx context.Context, zoneID, recordSetI
 
 	log.Debugf("→ Deleting recordset: %s", recordSetID)
 
-	err := recordsets.Delete(ctx, c.serviceClient, zoneID, recordSetID).ExtractErr()
+	err := recordsets.DeleteWithOpts(ctx, c.serviceClient, zoneID, recordSetID, recordsets.DeleteOpts{AllProjects: c.allProjects}).ExtractErr()
 
 	duration := time.Since(startTime)
 	metrics.ApiCallLatency.WithLabelValues("DeleteRecordSet").Observe(duration.Seconds())

internal/designate/provider/provider.go

@@ -56,8 +56,8 @@ type designateProvider struct {
 }
 
 // NewDesignateProvider is a factory function for OpenStack designate providers
-func NewDesignateProvider(domainFilter endpoint.DomainFilter, dryRun bool) (provider.Provider, error) {
-	client, err := client.NewDesignateClient()
+func NewDesignateProvider(domainFilter endpoint.DomainFilter, allProjects, dryRun bool) (provider.Provider, error) {
+	client, err := client.NewDesignateClient(allProjects)
 	if err != nil {
 		return nil, err
 	}

internal/designate/provider/provider_test.go

@@ -262,7 +262,7 @@ clouds:
 	os.Setenv("OS_CLOUD", "unittest")
 	os.Setenv("OS_CACERT", tmpfile.Name())
 
-	if _, err := NewDesignateProvider(endpoint.DomainFilter{}, true); err != nil {
+	if _, err := NewDesignateProvider(endpoint.DomainFilter{}, false, true); err != nil {
 		t.Fatalf("Failed to initialize Designate provider: %s", err)
 	}
 }