feat(dns): dns record requirer

.lycheeignore

@@ -1 +1 @@
-https://github.com/canonical/haproxy-operator/deployments/charmhub-stable-promote
+https://github.com/canonical/haproxy-operator/deployments/charmhub-stable-promote

docs/changelog.md

@@ -48,6 +48,10 @@ Each revision is versioned by the date of the revision.
 
 - Added relation endpoints reference page.
 
+## 2026-05-27
+
+- Added optional `dns-record` relation to publish DNS A records for HAProxy hostnames.
+
 ## 2026-05-26
 
 - Added `port_mapping` attribute to `haproxy-route-tcp` relation to allow mapping a range of frontend ports to a range of backend ports.

haproxy-operator/charmcraft.yaml

@@ -69,7 +69,9 @@ requires:
     interface: haproxy-route-policy
     optional: true
     limit: 1
-
+  dns-record:
+    interface: dns_record
+    optional: true
 
 provides:
   ingress:
@@ -162,9 +164,21 @@ actions:
       Client IP hash salts are redacted. Intended for debugging purposes.
 
 charm-libs:
-- lib: traefik_k8s.ingress_per_unit
+- lib: certificate_transfer_interface.certificate_transfer
   version: "1"
+- lib: grafana_agent.cos_agent
+  version: "0"
 - lib: haproxy.ddos_protection
   version: "0"
 - lib: haproxy_route_policy.haproxy_route_policy
   version: "0"
+- lib: operator_libs_linux.apt
+  version: "0"
+- lib: operator_libs_linux.systemd
+  version: "1"
+- lib: tls_certificates_interface.tls_certificates
+  version: "4"
+- lib: traefik_k8s.ingress
+  version: "2"
+- lib: traefik_k8s.ingress_per_unit
+  version: "1"

haproxy-operator/pyproject.toml

@@ -101,6 +101,7 @@ lint.ignore = [
   "UP045",
 ]
 lint.per-file-ignores."tests/*" = [ "B011", "D100", "D101", "D102", "D103", "D104", "D212", "D415", "D417", "S" ]
+lint.per-file-ignores."src/charms/dns_integrator/v0/dns_record.py" = [ "ALL" ]
 lint.per-file-ignores."tests/integration/grpc_server/*_pb2.py" = [ "ALL" ]
 lint.per-file-ignores."tests/integration/grpc_server/*_pb2_grpc.py" = [ "ALL" ]
 lint.flake8-copyright.author = "Canonical Ltd."

haproxy-operator/src/charm.py

@@ -49,6 +49,8 @@
 from ops.charm import ActionEvent
 from ops.model import Port, SecretNotFoundError
 
+from charms.dns_integrator.v0.dns_record import DNSRecordRequires
+from dns_record import DNS_RECORD_RELATION, DNSRecordService
 from haproxy import HAPROXY_CONFIG, HAPROXY_SERVICE, HAProxyService, file_exists, read_file
 from http_interface import (
     HTTPBackendAvailableEvent,
@@ -59,7 +61,12 @@
 from state.charm_state import CharmState, ProxyMode
 from state.ddos_protection import DDosProtection
 from state.exception import CharmStateValidationBaseError
-from state.ha import HACLUSTER_INTEGRATION, HAPROXY_PEER_INTEGRATION, HAInformation
+from state.ha import (
+    HACLUSTER_INTEGRATION,
+    HAPROXY_PEER_INTEGRATION,
+    HAInformation,
+    HAInformationValidationError,
+)
 from state.haproxy_route import (
     HAPROXY_ROUTE_RELATION,
     HAProxyRouteBackend,
@@ -172,6 +179,8 @@ def __init__(self, *args: typing.Any):
         )
 
         self._tls = TLSRelationService(self.model, self.certificates, self.recv_ca_certs)
+        self.dns_record_requirer = DNSRecordRequires(self)
+        self._dns_record_service = DNSRecordService(self.model, self.dns_record_requirer)
         self.website_requirer = HTTPProvider(self, WEBSITE_RELATION)
 
         self._grafana_agent = COSAgentProvider(
@@ -211,6 +220,18 @@ def __init__(self, *args: typing.Any):
             self._ingress_per_unit_provider.on.data_removed, self._on_ingress_data_removed
         )
         self.framework.observe(self.hacluster.on.ha_ready, self._on_config_changed)
+        self.framework.observe(
+            self.on[HACLUSTER_INTEGRATION].relation_changed, self._on_config_changed
+        )
+        self.framework.observe(
+            self.on[HACLUSTER_INTEGRATION].relation_broken, self._on_config_changed
+        )
+        self.framework.observe(
+            self.on[DNS_RECORD_RELATION].relation_created, self._on_config_changed
+        )
+        self.framework.observe(
+            self.on[DNS_RECORD_RELATION].relation_joined, self._on_config_changed
+        )
         self.framework.observe(
             self.recv_ca_certs.on.certificate_set_updated, self._on_ca_certificates_updated
         )
@@ -346,6 +367,8 @@ def _reconcile(self) -> None:
 
                 self.unit.set_ports(80)
                 self.haproxy_service.reconcile_default(charm_state)
+        if self.unit.is_leader():
+            self._update_dns_records()
         self.unit.status = ops.ActiveStatus(status_message)
 
     def _configure_ingress(
@@ -583,6 +606,41 @@ def _on_ca_certificates_removed(self, _: CertificatesRemovedEvent) -> None:
         """Handle the CA certificates removed event."""
         self._reconcile()
 
+    def _update_dns_records(self) -> None:
+        """Publish A records for all managed hostnames to the dns-record relation.
+
+        Uses the VIP when an HA relation is active, otherwise uses the ingress
+        binding address of this unit.
+
+        Called at the end of _reconcile(), so config/TLS validation has already passed.
+        """
+        if not self.unit.is_leader():
+            return
+
+        hostnames = [req.common_name for req in self._get_certificate_requests()]
+        if not hostnames:
+            return
+
+        try:
+            ha_information = HAInformation.from_charm(self)
+        except HAInformationValidationError:
+            ha_information = None
+
+        if ha_information and ha_information.ha_integration_ready and ha_information.vip:
+            ip = str(ha_information.vip)
+        else:
+            network_binding = self.model.get_binding(DNS_RECORD_RELATION)
+            if network_binding is None:
+                logger.warning("Cannot resolve network binding for DNS records.")
+                return
+            ingress_addresses = network_binding.network.ingress_addresses
+            if not ingress_addresses:
+                logger.warning("No ingress addresses found; skipping DNS record update.")
+                return
+            ip = str(ingress_addresses[0])
+
+        self._dns_record_service.update_dns_records(hostnames, ip)
+
     @validate_config_and_tls(defer=False)
     def _on_ingress_per_unit_data_provided(self, _: IngressDataReadyEvent) -> None:
         """Handle the data-provided event for ingress-per-unit."""