unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

dns: fix dns-update fqdn() double-appending zone to FQDN records #481

Merged
benvin merged 1 commits from benvin/dns-update-fqdn-fix into develop 2026-07-17 22:50:29 +10:00
Conversation 0 Commits 1 Files Changed 1
+9 -1
unkinben commented 2026-07-17 22:45:39 +10:00
Owner
Copy Link
Copy Source

Why

6 hosts (ausyd1nxvm2069-2073, 2098) ended up with a reverse PTR in bind-authoritative but no forward A record, and the unkin.net service records (git/grafana/auth/fafflix, all published by the halb host 2069) never landed at all.

VictoriaLogs (dns-update-apply on 2069 & 2070) shows the cause:

dns-update: nsupdate to 198.18.200.9 failed
invalid owner name: empty label
syntax error

profiles::dns::record publishes some records whose name is already fully-qualified (trailing dot) — e.g. au-syd1-pve.main.unkin.net., cobbler.main.unkin.net., dashboard.ceph.unkin.net., and the halb CNAMEs. The dns-update script fqdn() unconditionally appended the zone, producing …net..main.unkin.net. — the .. is an empty label, which nsupdate rejects, failing the entire per-zone send. The reverse-PTR send is sorted first and its name is always relative, so it still applied — hence "PTR but no A".

Change

fqdn() now handles three cases:

  • @/empty → zone apex (unchanged)
  • name ending in . → already FQDN, used verbatim (the fix)
  • otherwise → relative, append .zone. (unchanged)

Verified against all record shapes (relative host, apex, FQDN CNAME, reverse label) — no more ...

After merge

Once puppet re-runs on the affected hosts their main.unkin.net/unkin.net updates succeed, filling in the missing A records and the unkin.net service zone. Pairs with argocd-apps#260 (adds the ceph.unkin.net zone so dashboard.ceph.unkin.net does not then hit NOTZONE).

## Why 6 hosts (ausyd1nxvm2069-2073, 2098) ended up with a reverse PTR in bind-authoritative but **no forward A record**, and the `unkin.net` service records (git/grafana/auth/fafflix, all published by the halb host 2069) never landed at all. VictoriaLogs (`dns-update-apply` on 2069 & 2070) shows the cause: ``` dns-update: nsupdate to 198.18.200.9 failed invalid owner name: empty label syntax error ``` `profiles::dns::record` publishes some records whose name is already fully-qualified (trailing dot) — e.g. `au-syd1-pve.main.unkin.net.`, `cobbler.main.unkin.net.`, `dashboard.ceph.unkin.net.`, and the halb CNAMEs. The `dns-update` script `fqdn()` unconditionally appended the zone, producing `…net..main.unkin.net.` — the `..` is an empty label, which nsupdate rejects, failing the entire per-zone `send`. The reverse-PTR send is sorted first and its name is always relative, so it still applied — hence "PTR but no A". ## Change `fqdn()` now handles three cases: - `@`/empty → zone apex (unchanged) - name ending in `.` → already FQDN, used verbatim (**the fix**) - otherwise → relative, append `.zone.` (unchanged) Verified against all record shapes (relative host, apex, FQDN CNAME, reverse label) — no more `..`. ## After merge Once puppet re-runs on the affected hosts their `main.unkin.net`/`unkin.net` updates succeed, filling in the missing A records and the `unkin.net` service zone. Pairs with argocd-apps#260 (adds the `ceph.unkin.net` zone so `dashboard.ceph.unkin.net` does not then hit NOTZONE).
unkinben added 1 commit 2026-07-17 22:45:39 +10:00
dns: fix dns-update fqdn() double-appending zone to FQDN records
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
c3d8de5060 
profiles::dns::record publishes some records with an already-qualified name
(trailing dot), e.g. au-syd1-pve.main.unkin.net., cobbler.main.unkin.net.,
dashboard.ceph.unkin.net., and the halb service CNAMEs. The dns-update
script's fqdn() unconditionally appended the zone, producing a '..' empty
label; nsupdate rejects the whole per-zone update with 'invalid owner name:
empty label' + 'syntax error'. The reverse-PTR send (sorted first, always
relative) still applied, so affected hosts ended up with a PTR but no A.

Handle the already-FQDN case (name ends in '.') by using it verbatim; keep
the apex ('@'/empty) and relative cases as before.

Fixes hosts stuck with PTR-but-no-A (e.g. ausyd1nxvm2069-2073, 2098) and
repopulates the unkin.net service records (git/grafana/auth/fafflix).
benvin merged commit 0de3ac2a0b into develop 2026-07-17 22:50:29 +10:00
benvin deleted branch benvin/dns-update-fqdn-fix 2026-07-17 22:50:29 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#481
Delete Branch "benvin/dns-update-fqdn-fix"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?