Load Balancer DNS resolution takes too long

[r4f4]

trafficstars

/kind bug

What steps did you take and what happened:

This issue was discovered by @jianlinliu, @gpei, and @yunjiang29.

As the load balancer reconciliation currently stands, CAPA tries to check for LB DNS name resolution right after the load balancer is created. The DNS name resolution success is necessary for CAPA to deem the LB as ready [1].

DNS name propagation can usually take a few minutes. If we try to resolve the name too soon, we might get:

$ nslookup -debug lb.notvalid.address.com
Server:		127.0.0.53
Address:	127.0.0.53#53

------------
    QUESTIONS:
	lb.notvalid.address.com, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  address.com
	origin = ns-93.awsdns-11.com
	mail addr = awsdns-hostmaster.amazon.com
	serial = 1
	refresh = 7200
	retry = 900
	expire = 1209600
	minimum = 86400
	ttl = 600
    ADDITIONAL RECORDS:
------------
** server can't find lb.notvalid.address.com: NXDOMAIN

and the name resolution will keep failing with the cached answer for the next TTL=600s=10min.

We have observed in some systems that the TTL for LB DNS in the us-gov-west-1 region could be as high as 900s.

$ dig jialiu-735f8ebd8bc9a14e.elb.us-gov-west-1.amazonaws.com; <<>> DiG 9.11.36-RedHat-9.11.36-5.el8_7.2 <<>> jialiu-735f8ebd8bc9a14e.elb.us-gov-west-1.amazonaws.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 27112
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1220
; COOKIE: 2caaa84d7bd004acf1e8a4aa667508daacf8365c3d922552 (good)
;; QUESTION SECTION:
;jialiu-735f8ebd8bc9a14e.elb.us-gov-west-1.amazonaws.com. IN A;; AUTHORITY SECTION:
elb.us-gov-west-1.amazonaws.com. 900 IN    SOA    ns-1151.awsdns-15.org. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 60;; Query time: 12 msec
;; SERVER: 10.11.5.160#53(10.11.5.160)
;; WHEN: Fri Jun 21 01:00:10 EDT 2024
;; MSG SIZE  rcvd: 194

[1] https://github.com/kubernetes-sigs/cluster-api-provider-aws/blob/main/controllers/awscluster_controller.go#L291-L298

What did you expect to happen:

To get around this problem, maybe we can wait after the LB is created until the resolution is most likely to succeed (around 2min) before attempting the first DNS resolution. This would decrease the chance of waiting too long for the LB name to resolve due to high TTLs.

Anything else you would like to add:

PR to follow soon.

Environment:

• Cluster-api-provider-aws version: master @ 7ab0780c89fe321df2a9bebc232dd2c9b2670db4
• Kubernetes version: (use kubectl version):
• OS (e.g. from /etc/os-release):