Create a resolver inbound endpoint.
curl --request POST \ --url https://stratum.example.com/v1/projects/example/dns/resolver-inbound-endpoints \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "vpcId": "example", "floatingIPId": "example", "allowedCidrs": [ "example" ], "subnetIds": [ "example" ], "securityGroupIds": [ "example" ], "tags": { "additionalProperty": "example" } }'Binds an allocated floating IP to the VPC’s managed recursor
so clients outside the fabric — for whom the floating-IP pool
is the routable range — can resolve the VPC’s private zones
(instance DNS, compute.internal, plus whatever the VPC’s
resolver rules forward). Requires the VPC to have
dnsResolution: true. One live endpoint per VPC.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
An allocated (unassociated) floating IP owned by the project.
Client networks permitted to query through this endpoint, e.g.
["172.24.0.0/16"] for an on-prem resolver’s subnet.
An endpoint with an empty list answers only the VPC’s own clients,
which is to say it does nothing an inbound endpoint is for. DNAT
rewrites the destination only, so an off-cluster resolver arrives with
its real source address, outside the VPC CIDR — and the recursor’s
default is 0.0.0.0/0 refuse. The symptom is a timeout rather than a
REFUSED, because the refusal itself takes the netns mgmt-plane default
route out and never reaches the client.
The list drives both halves: the recursor’s access-control allow list,
and the netns return routes via the VPC gateway so the answer egresses
back through OVN. Naming a network here is what makes it work in both
directions.
0.0.0.0/0 is rejected. The endpoint sits on a routable floating IP, so
an all-sources list makes this an open recursive resolver — a DNS
amplification reflector. Name the specific client networks.
Tenant subnets the endpoint places an interface in.
Each one gets a Stratum-owned NIC with an address in that subnet, and that NIC is what the floating IP forwards to. AWS asks for subnets on a resolver endpoint for the same reason: the endpoint IS its interfaces, and an interface has to live somewhere.
Omit to keep the pre- behaviour, where the endpoint forwards straight to the VPC’s shared recursor address. That path cannot carry security groups — see securityGroupIds.
Security groups applied to the endpoint’s interfaces. Requires subnetIds: a security group binds to a PORT, so the endpoint needs one of its own before this can mean anything.
This is why it needs its own interface rather than a field on the shared recursor port: an SG there would govern in-VPC queries too, and a rule that missed a legitimate source would take DNS from every instance in the VPC. With its own port, a mistake here costs the endpoint and nothing else.
Mutually exclusive with allowedCidrs — the two express the same intent through different mechanisms, and accepting both would leave the question of which wins.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Example generated
{ "vpcId": "example", "floatingIPId": "example", "allowedCidrs": [ "example" ], "subnetIds": [ "example" ], "securityGroupIds": [ "example" ], "tags": { "additionalProperty": "example" }}Responses
Section titled “Responses”Accepted.
object
The floating IP address on-prem resolvers point at (port 53 udp+tcp).
Client networks permitted to query through this endpoint. Empty means only the VPC’s own clients can resolve through it. See CreateResolverInboundEndpointRequest.allowedCidrs.
Tenant subnets the endpoint has an interface in.
Security groups applied to the endpoint’s interfaces. Empty when the endpoint uses the pre- shared-recursor path.
The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Example
{ "state": "available"}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Conflicting state.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}