IHAC who is facing a core issue  with the current implementation of user-provisioned DNS in AWS, which is not functional in Top Secret regions that it's not available at all currently for Top Secret AWS regions

As per engineering, and available product documentation User Provisioned DNS or Custom DNS is expected to go GA in 4.22 for AWS and Azure. Currently, in v4.21 this has been added as Tech Preview feature. 

CORE ISSUE:
The installation fails in a Top Secret region with the error: "FATAL unable to handle api server override: no IP address found in lbconfig."

CAUSE:
The installer attempts to retrieve IP addresses for the API load balancer by searching for network interfaces with specific security groups. However, in Top Secret regions, network load balancers' interfaces cannot have security groups, a limitation documented by AWS. While the Cluster API handles this elsewhere, the newer code does not account for it.

SUGGESTED FIX:
Modify the installer to obtain the IP addresses for the API load balancer in the same manner as the Ingress Operator does for the ingress load balancer--by resolving its DNS name.



This feature would be extremely beneficial for them so they could utilize IPI clusters with custom/user specified DNS server since their end-customers in the intel community have extremely tight security requirements. If this feature could be added to TS/restricted AWS regions this would simplify their deployment and management.

v4.21    

    Always

    1. Provision the IPI cluster on AWS in specialized regions and using custom DNS following this documentation[1] and enable user managed DNS.

[1] https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/installing_on_aws/index#installation-aws-provisioning-own-dns-records_installing-aws-customizations

[2] https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/installing_on_aws/index#installation-aws-enabling-user-managed-DNS_installing-aws-customizations


   
    

    The installation would fail with the error "FATAL unable to handle api server override: no IP address found in lbconfig"

The installation should succeed and no errors should be observed