dns: nsupdate host records to the authoritative server (#475)
Replaces the exported-resources → puppet DNS master zone-file flow with per-host RFC2136 dynamic updates against the k8s **bind-authoritative** write endpoint (198.18.200.9). The master no longer manages zone files. ## Design Each node assembles its DNS records into a local concat file; a systemd `.path` unit watches it and runs `dns-update` (nsupdate) on change — exactly the watch-a-file model requested. ## Changes - **profiles::dns::updater** (new): concat records file + TSIG key file + `dns-update` script + `dns-update.service` (oneshot) + `dns-update.path` (watcher). The script sends only the delta since last run and deletes removed records, grouped per zone. - **profiles::dns::record**: writes a local concat fragment (`zone|name|type|ttl|value`) instead of exporting `@@concat::fragment` to the master. - **profiles::dns::base**: includes `profiles::dns::updater` (all nodes). - **hiera**: `profiles::dns::updater` server/key_name/algorithm in common.yaml. ## Inert until keyed The updater does nothing until `profiles::dns::updater::key_secret` (TSIG) is set in eyaml — records are assembled but not applied, so nodes are safe before the key exists. ## Prerequisites (k8s side, separate) 1. The `bind-authoritative` zones must set `dynamicUpdate: true` + an `updateKeyRef` (a client-update BindTSIGKey) so they accept these updates. 2. The TSIG key must be shared: the operator-generated key value goes into eyaml here (or the planned Vault-sync feature bridges it). ## Validated puppet parser/epp validate, puppet-lint, and a functional test of the generated per-zone nsupdate message (replace + delete-removed). Reviewed-on: #475 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #475.
This commit is contained in:
@@ -11,9 +11,12 @@ class profiles::dns::base (
|
||||
Optional[String] $ns_role = undef,
|
||||
){
|
||||
|
||||
# install bind_utils
|
||||
# install bind_utils (provides nsupdate)
|
||||
include bind::updater
|
||||
|
||||
# assemble the host's DNS records and nsupdate them to the authoritative server
|
||||
include profiles::dns::updater
|
||||
|
||||
# if ns_role is set, find all hosts matching that enc_role
|
||||
$nameserver_array = $ns_role ? {
|
||||
undef => $nameservers,
|
||||
|
||||
@@ -1,4 +1,10 @@
|
||||
# defines the base record that will be exported
|
||||
# profiles::dns::record
|
||||
#
|
||||
# Declares a DNS record for this host. Publishes it via either or both methods,
|
||||
# controlled by profiles::dns::updater's toggles (both on during cutover):
|
||||
# - nsupdate: a local concat fragment consumed by profiles::dns::updater,
|
||||
# which nsupdates it to the authoritative server.
|
||||
# - export: the legacy @@concat::fragment exported to the puppet DNS master.
|
||||
define profiles::dns::record (
|
||||
String $record,
|
||||
Enum[
|
||||
@@ -13,11 +19,26 @@ define profiles::dns::record (
|
||||
String $value,
|
||||
String $zone,
|
||||
Integer $order,
|
||||
Stdlib::AbsolutePath $basedir = lookup('profiles::dns::master::basedir'),
|
||||
Integer $ttl = 300,
|
||||
) {
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
include profiles::dns::updater
|
||||
|
||||
# new: local records file consumed by the nsupdate service
|
||||
if $profiles::dns::updater::manage_nsupdate {
|
||||
# zone|name|type|ttl|value (parsed by the dns-update script)
|
||||
concat::fragment { "dns-record-${name}":
|
||||
target => $profiles::dns::updater::records_file,
|
||||
content => "${zone}|${record}|${type}|${ttl}|${value}\n",
|
||||
order => sprintf('%03d', $order),
|
||||
}
|
||||
}
|
||||
|
||||
# legacy: export the fragment to the puppet DNS master
|
||||
if $profiles::dns::updater::manage_export {
|
||||
@@concat::fragment { "${zone}_${name}":
|
||||
target => "${profiles::dns::updater::master_basedir}/${zone}.conf",
|
||||
content => "${record} IN ${type} ${value}\n",
|
||||
order => $order,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,127 @@
|
||||
# profiles::dns::updater
|
||||
#
|
||||
# Publishes this host's DNS records. Two methods, independently toggled so both
|
||||
# can run during the k8s cutover (profiles::dns::record honours the same flags):
|
||||
#
|
||||
# - nsupdate ($manage_nsupdate): assemble the records into a local file and
|
||||
# nsupdate them to the k8s authoritative write endpoint via a systemd .path
|
||||
# unit that watches the file. Inert until $key_secret (TSIG) is set.
|
||||
# - export ($manage_export): the legacy exported-resources flow to the puppet
|
||||
# DNS master. Kept during cutover; disable once k8s is authoritative.
|
||||
#
|
||||
# nsupdate comes from bind-utils (installed via bind::updater in
|
||||
# profiles::dns::base).
|
||||
class profiles::dns::updater (
|
||||
Boolean $manage_nsupdate = true,
|
||||
Boolean $manage_export = true,
|
||||
String $server = '198.18.200.9',
|
||||
String $key_name = 'client-update',
|
||||
String $key_algorithm = 'hmac-sha256',
|
||||
Optional[Sensitive[String]] $key_secret = undef,
|
||||
Integer $default_ttl = 300,
|
||||
Stdlib::AbsolutePath $records_file = '/var/lib/dns-updater/records',
|
||||
Stdlib::AbsolutePath $state_dir = '/var/lib/dns-updater',
|
||||
Stdlib::AbsolutePath $config_dir = '/etc/dns-updater',
|
||||
Stdlib::AbsolutePath $master_basedir = lookup('profiles::dns::master::basedir'),
|
||||
) {
|
||||
|
||||
$state_file = "${state_dir}/applied"
|
||||
$server_file = "${state_dir}/server"
|
||||
$key_file = "${config_dir}/key"
|
||||
|
||||
if $manage_nsupdate {
|
||||
|
||||
file { $state_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
}
|
||||
|
||||
# Server address, read by the dns_records fact for drift detection.
|
||||
file { $server_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
content => "${server}\n",
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
# Records file, assembled from profiles::dns::record fragments.
|
||||
concat { $records_file:
|
||||
ensure => present,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0644',
|
||||
ensure_newline => true,
|
||||
warn => false,
|
||||
require => File[$state_dir],
|
||||
}
|
||||
|
||||
concat::fragment { 'dns-update-header':
|
||||
target => $records_file,
|
||||
content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
|
||||
order => '00',
|
||||
}
|
||||
|
||||
if $key_secret =~ Undef {
|
||||
notify { 'dns-updater-inert':
|
||||
message => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
|
||||
loglevel => 'info',
|
||||
}
|
||||
} else {
|
||||
file { $config_dir:
|
||||
ensure => directory,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0700',
|
||||
}
|
||||
|
||||
file { $key_file:
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0600',
|
||||
show_diff => false,
|
||||
content => Sensitive(epp('profiles/dns/tsig-key.epp', {
|
||||
'name' => $key_name,
|
||||
'algorithm' => $key_algorithm,
|
||||
'secret' => $key_secret.unwrap,
|
||||
})),
|
||||
}
|
||||
|
||||
file { '/usr/local/bin/dns-update':
|
||||
ensure => file,
|
||||
owner => 'root',
|
||||
group => 'root',
|
||||
mode => '0755',
|
||||
content => epp('profiles/dns/dns-update.sh.epp', {
|
||||
'server' => $server,
|
||||
'key_file' => $key_file,
|
||||
'records_file' => $records_file,
|
||||
'state_file' => $state_file,
|
||||
}),
|
||||
}
|
||||
|
||||
systemd::unit_file { 'dns-update.service':
|
||||
content => epp('profiles/dns/dns-update.service.epp', { 'script' => '/usr/local/bin/dns-update' }),
|
||||
}
|
||||
|
||||
# The .path unit watches the records file and triggers the service.
|
||||
systemd::unit_file { 'dns-update.path':
|
||||
content => epp('profiles/dns/dns-update.path.epp', { 'records_file' => $records_file }),
|
||||
active => true,
|
||||
enable => true,
|
||||
}
|
||||
|
||||
# Also apply within the puppet run whenever the records change.
|
||||
exec { 'dns-update-apply':
|
||||
command => '/usr/local/bin/dns-update',
|
||||
refreshonly => true,
|
||||
subscribe => Concat[$records_file],
|
||||
require => [File['/usr/local/bin/dns-update'], File[$key_file]],
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
<%- | String $records_file | -%>
|
||||
[Unit]
|
||||
Description=Watch the DNS records file and apply changes
|
||||
|
||||
[Path]
|
||||
PathModified=<%= $records_file %>
|
||||
Unit=dns-update.service
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,9 @@
|
||||
<%- | String $script | -%>
|
||||
[Unit]
|
||||
Description=Apply host DNS records via nsupdate
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=<%= $script %>
|
||||
@@ -0,0 +1,56 @@
|
||||
<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
|
||||
#!/bin/bash
|
||||
# Managed by puppet (profiles::dns::updater). Applies this host's records to the
|
||||
# authoritative DNS server via TSIG nsupdate. Only the delta since the last
|
||||
# successful run is sent; removed records are deleted.
|
||||
set -euo pipefail
|
||||
|
||||
SERVER="<%= $server %>"
|
||||
KEYFILE="<%= $key_file %>"
|
||||
RECORDS="<%= $records_file %>"
|
||||
STATE="<%= $state_file %>"
|
||||
|
||||
[ -f "$RECORDS" ] || exit 0
|
||||
touch "$STATE"
|
||||
|
||||
# Format per line: zone|name|type|ttl|value (name is relative to zone, or @).
|
||||
desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
|
||||
applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
|
||||
|
||||
[ "$desired" = "$applied" ] && exit 0
|
||||
|
||||
fqdn() { # name zone
|
||||
if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
|
||||
}
|
||||
|
||||
msg="$(mktemp)"
|
||||
trap 'rm -f "$msg"' EXIT
|
||||
printf 'server %s\n' "$SERVER" >> "$msg"
|
||||
|
||||
# Process per zone so each UPDATE message targets a single zone.
|
||||
zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
|
||||
for zone in $zones; do
|
||||
printf 'zone %s.\n' "$zone" >> "$msg"
|
||||
# Additions/updates: replace the RRset for every desired record in this zone.
|
||||
printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
||||
while IFS='|' read -r z name type ttl value; do
|
||||
f="$(fqdn "$name" "$z")"
|
||||
printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
|
||||
printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
|
||||
done
|
||||
# Deletions: records present last run but gone now.
|
||||
comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
|
||||
awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
||||
while IFS='|' read -r z name type ttl value; do
|
||||
f="$(fqdn "$name" "$z")"
|
||||
printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
|
||||
done
|
||||
printf 'send\n' >> "$msg"
|
||||
done
|
||||
|
||||
if nsupdate -k "$KEYFILE" "$msg"; then
|
||||
printf '%s\n' "$desired" > "$STATE"
|
||||
else
|
||||
echo "dns-update: nsupdate to ${SERVER} failed" >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,5 @@
|
||||
<%- | String $name, String $algorithm, String $secret | -%>
|
||||
key "<%= $name %>" {
|
||||
algorithm <%= $algorithm %>;
|
||||
secret "<%= $secret %>";
|
||||
};
|
||||
Reference in New Issue
Block a user