unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

dns: fix dns-update fqdn() double-appending zone to FQDN records (#481)

Browse Source 
## Why
6 hosts (ausyd1nxvm2069-2073, 2098) ended up with a reverse PTR in bind-authoritative but **no forward A record**, and the `unkin.net` service records (git/grafana/auth/fafflix, all published by the halb host 2069) never landed at all.

VictoriaLogs (`dns-update-apply` on 2069 & 2070) shows the cause:
```
dns-update: nsupdate to 198.18.200.9 failed
invalid owner name: empty label
syntax error
```
`profiles::dns::record` publishes some records whose name is already fully-qualified (trailing dot) — e.g. `au-syd1-pve.main.unkin.net.`, `cobbler.main.unkin.net.`, `dashboard.ceph.unkin.net.`, and the halb CNAMEs. The `dns-update` script `fqdn()` unconditionally appended the zone, producing `…net..main.unkin.net.` — the `..` is an empty label, which nsupdate rejects, failing the entire per-zone `send`. The reverse-PTR send is sorted first and its name is always relative, so it still applied — hence "PTR but no A".

## Change
`fqdn()` now handles three cases:
- `@`/empty → zone apex (unchanged)
- name ending in `.` → already FQDN, used verbatim (**the fix**)
- otherwise → relative, append `.zone.` (unchanged)

Verified against all record shapes (relative host, apex, FQDN CNAME, reverse label) — no more `..`.

## After merge
Once puppet re-runs on the affected hosts their `main.unkin.net`/`unkin.net` updates succeed, filling in the missing A records and the `unkin.net` service zone. Pairs with argocd-apps#260 (adds the `ceph.unkin.net` zone so `dashboard.ceph.unkin.net` does not then hit NOTZONE).

Reviewed-on: #481
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #481.
This commit is contained in:
Ben Vincent
2026-07-17 22:50:28 +10:00
committed by BenVincent
parent 0702676da6
commit 0de3ac2a0b
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
site/profiles/templates/dns/dns-update.sh.epp
+9 -1
View File
@@ -20,7 +20,15 @@ applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)
[ "$desired" = "$applied" ] && exit 0
fqdn() { # name zone
if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
# $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
# (trailing dot). Only append the zone in the relative case; appending it to
# an already-qualified name yields a "..", which nsupdate rejects as an
# "invalid owner name: empty label".
case "$1" in
''|'@') printf '%s.' "$2" ;;
*.) printf '%s' "$1" ;;
*) printf '%s.%s.' "$1" "$2" ;;
esac
}
msg="$(mktemp)"