haproxy::dns: fully-qualify halb CNAME targets #489
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/puppet-prod#489
Reference in New Issue
Block a user
Delete Branch "benvin/halb-cname-fqdn"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
The halb publishes service CNAMEs (
git.unkin.net,dashboard.ceph.unkin.net, and every other halb-fronted name) with a bare target label, e.g.:dns-updaterbuilds the RR withdns.NewRRand no $ORIGIN, so a bare value becomes root-absolute (au-syd1-prod-halb-vrrp.) and dead-ends in NXDOMAIN. Once the k8s bind became authoritative for these zones, that broke resolution of every halb-fronted service (git, the Ceph dashboard, ...).au-syd1-prod-halb-vrrp.unkin.net/.main.unkin.netresolve fine (198.18.19.17) — only the CNAME target was truncated.Change (
site/profiles/manifests/haproxy/dns.pp)Emit fully-qualified CNAME targets (trailing dot), the FQDN form
dns-updaterexpects (per its own test fixtureau-syd1-prod-halb.main.unkin.net.):${location_environment}-halb-vrrp.${domain}.${location_environment}-halb.${domain}.The matching A records are already published in
main.unkin.net/unkin.netjust above, so the targets resolve to the VIP.The halb published service CNAMEs (git.unkin.net, dashboard.ceph.unkin.net, ...) with a bare target label ("au-syd1-prod-halb-vrrp"). dns-updater parses the record value with no $ORIGIN, so a bare label becomes root-absolute ("au-syd1-prod-halb-vrrp.") and dead-ends in NXDOMAIN -- breaking every halb-fronted name once the k8s bind became authoritative. Emit fully-qualified targets (trailing dot) for both the vrrp and non-vrrp CNAMEs, matching the FQDN value dns-updater expects: - au-syd1-prod-halb-vrrp.<domain>. and au-syd1-prod-halb.<domain>.