From 206a4521e565c257266a957af0ea1107bde01d53 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Mon, 20 Jul 2026 23:17:12 +1000 Subject: [PATCH] Fix cobbler.main.unkin.net CNAME to resolve on k8s DNS (#491) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cobbler master exports `cobbler.main.unkin.net` as a CNAME whose value is the bare hostname (`ausyd1nxvm2098`). The legacy puppet DNS master loaded this into a zone file under `$ORIGIN main.unkin.net.`, so BIND completed the bare label to `ausyd1nxvm2098.main.unkin.net.` and it resolved. `dns-updater` renders RFC2136 updates with no `$ORIGIN`, so the same bare label becomes root-absolute (`ausyd1nxvm2098.`) and dead-ends in NXDOMAIN — the record exists on the k8s authoritative servers (and via the resolvers at 198.18.200.7) but has no reachable address. This is the same failure already documented and fixed for haproxy in `profiles::haproxy::dns`. Changes: - Set the cobbler CNAME `value` to the fully-qualified `${facts.networking.fqdn}.` (trailing dot) so the target is origin-independent and resolves identically on both the legacy zone-file export and the dns-updater nsupdate path. - Add an explanatory comment mirroring the one in `profiles::haproxy::dns` to prevent reintroducing a bare label. Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/491 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- site/profiles/manifests/cobbler/config.pp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/site/profiles/manifests/cobbler/config.pp b/site/profiles/manifests/cobbler/config.pp index 3042d98..adce4aa 100644 --- a/site/profiles/manifests/cobbler/config.pp +++ b/site/profiles/manifests/cobbler/config.pp @@ -68,7 +68,10 @@ class profiles::cobbler::config { # export cnames for cobbler if $is_cobbler_master { profiles::dns::record { "${::facts['networking']['fqdn']}_${service_cname}_CNAME": - value => $::facts['networking']['hostname'], + # CNAME target must be a fully-qualified name (trailing dot): dns-updater + # parses the value with no $ORIGIN, so a bare label becomes root-absolute + # ("ausyd1nxvm2098.") and dead-ends in NXDOMAIN. + value => "${::facts['networking']['fqdn']}.", type => 'CNAME', record => "${service_cname}.", zone => $::facts['networking']['domain'],