From 918c4f20e1d144a1b89d761caf358a18ae340eda Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 19 Jul 2026 01:37:06 +1000 Subject: [PATCH] haproxy::dns: fully-qualify halb CNAME targets (#489) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The halb publishes service CNAMEs (`git.unkin.net`, `dashboard.ceph.unkin.net`, and every other halb-fronted name) with a **bare target label**, e.g.: ``` git.unkin.net. 300 IN CNAME au-syd1-prod-halb-vrrp. ``` `dns-updater` builds the RR with `dns.NewRR` and **no $ORIGIN**, so a bare value becomes root-absolute (`au-syd1-prod-halb-vrrp.`) and dead-ends in NXDOMAIN. Once the k8s bind became authoritative for these zones, that broke resolution of every halb-fronted service (git, the Ceph dashboard, ...). `au-syd1-prod-halb-vrrp.unkin.net` / `.main.unkin.net` resolve fine (198.18.19.17) — only the CNAME target was truncated. ## Change (`site/profiles/manifests/haproxy/dns.pp`) Emit **fully-qualified** CNAME targets (trailing dot), the FQDN form `dns-updater` expects (per its own test fixture `au-syd1-prod-halb.main.unkin.net.`): - vrrp cnames: `${location_environment}-halb-vrrp.${domain}.` - non-vrrp cnames: `${location_environment}-halb.${domain}.` The matching A records are already published in `main.unkin.net`/`unkin.net` just above, so the targets resolve to the VIP. --------- Co-authored-by: benvin Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/489 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- site/profiles/manifests/haproxy/dns.pp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/site/profiles/manifests/haproxy/dns.pp b/site/profiles/manifests/haproxy/dns.pp index 8338ea2..159e598 100644 --- a/site/profiles/manifests/haproxy/dns.pp +++ b/site/profiles/manifests/haproxy/dns.pp @@ -21,7 +21,10 @@ class profiles::haproxy::dns ( $parts = split($cname, '\.') $domain = join($parts[1, $parts.length], '.') profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME": - value => "${location_environment}-halb", + # CNAME target must be a fully-qualified name (trailing dot): dns-updater + # parses the value with no $ORIGIN, so a bare label becomes root-absolute + # ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN. + value => "${location_environment}-halb.${facts['networking']['domain']}.", type => 'CNAME', record => "${cname}.", zone => $domain, @@ -58,7 +61,10 @@ class profiles::haproxy::dns ( $parts = split($cname, '\.') $domain = join($parts[1, $parts.length], '.') profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME": - value => "${location_environment}-halb-vrrp", + # Fully-qualified target (trailing dot); see the note on the non-vrrp + # cnames above. The matching A record is published in main.unkin.net + # and unkin.net just above. + value => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.", type => 'CNAME', record => "${cname}.", zone => $domain,