unkin/puppet-prod
3
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

dns: exclude k8s/LB ranges from dns-updater; track latest #485

Merged
benvin merged 1 commits from benvin/dns-updater-filters into develop 2026-07-18 13:58:43 +10:00
Conversation 0 Commits 1 Files Changed 1
+21 -2
unkinben commented 2026-07-18 02:02:04 +10:00
Owner
Copy Link
Copy Source

Configures the dns-updater record filter (dns-updater#3) so k8s/LB/internal addresses stay out of the authoritative zones.

Why

Hosts publish records the authoritative server should not hold — *-flannel.1 A 10.42.x, *-kube-lb0 A 198.18.200.x, and the matching reverse PTRs (200.18.198, 2.42.10) — which the daemon WARNs NOTAUTH/bad authentication on.

Changes

  • DNS_UPDATER_DENY_RANGES=198.18.199.0/24,198.18.200.0/24,10.42.0.0/16,10.43.0.0/16 (pod CIDR, service CIDR, LB VIP pool, .199).
  • New class params: deny_ranges / allow_ranges / deny_domains / allow_domains.
  • package_ensure → latest so hosts pick up the filter release (rpm-internal metadata_expire is 1h, so no thrash).

Sequencing

Needs dns-updater #3 merged + a new tag (v0.2.0) so the filter env vars are honored. The env keys are ignored by v0.1.0, so this is safe to merge first — it takes effect when hosts upgrade to v0.2.0.

Configures the dns-updater record filter (dns-updater#3) so k8s/LB/internal addresses stay out of the authoritative zones. ## Why Hosts publish records the authoritative server should not hold — `*-flannel.1 A 10.42.x`, `*-kube-lb0 A 198.18.200.x`, and the matching reverse PTRs (`200.18.198`, `2.42.10`) — which the daemon WARNs `NOTAUTH`/`bad authentication` on. ## Changes - `DNS_UPDATER_DENY_RANGES=198.18.199.0/24,198.18.200.0/24,10.42.0.0/16,10.43.0.0/16` (pod CIDR, service CIDR, LB VIP pool, .199). - New class params: `deny_ranges` / `allow_ranges` / `deny_domains` / `allow_domains`. - `package_ensure` → `latest` so hosts pick up the filter release (rpm-internal `metadata_expire` is 1h, so no thrash). ## Sequencing Needs dns-updater **#3** merged + a new tag (v0.2.0) so the filter env vars are honored. The env keys are ignored by v0.1.0, so this is safe to merge first — it takes effect when hosts upgrade to v0.2.0.
unkinben added 1 commit 2026-07-18 02:02:04 +10:00
dns: exclude k8s/LB ranges from dns-updater; track latest
ci/woodpecker/pr/ruby-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-lint Pipeline was successful
Details
ci/woodpecker/pr/yamllint Pipeline was successful
Details
ci/woodpecker/pr/bolt-validate Pipeline was successful
Details
ci/woodpecker/pr/erb-validate Pipeline was successful
Details
ci/woodpecker/pr/epp-validate Pipeline was successful
Details
ci/woodpecker/pr/puppet-validate Pipeline was successful
Details
ci/woodpecker/pr/ruby-check Pipeline was successful
Details
8bfd768764 
Sets DNS_UPDATER_DENY_RANGES so the daemon never publishes records whose
address is in the k8s pod CIDR (10.42.0.0/16), service CIDR (10.43.0.0/16), the
LB VIP pool (198.18.200.0/24) or 198.18.199.0/24 — keeping kube-lb0/flannel/etc.
and their reverse PTRs out of the authoritative zones and stopping NOTAUTH
updates for zones we do not host. Exposes deny/allow ranges+domains as class
params. Also bumps package_ensure to 'latest' so hosts pick up the filter
release (rpm-internal metadata_expire is 1h).
benvin merged commit 9aa470d329 into develop 2026-07-18 13:58:43 +10:00
benvin deleted branch benvin/dns-updater-filters 2026-07-18 13:58:44 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#485
Delete Branch "benvin/dns-updater-filters"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?