dns: deploy dns-updater daemon in place of the shell nsupdate script [HOLD: needs dns-updater RPM published] #482
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/puppet-prod#482
Reference in New Issue
Block a user
Delete Branch "benvin/dns-updater-daemon"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
Replace the
profiles::dns::updatershell mechanism (dns-update.sh+dns-update.path/.service+ the in-runexec) with the packaged dns-updater daemon. The daemon watches the records file (inotify) and network interfaces and pushes TSIG-signed RFC2136 updates to BIND natively — with structured per-zone RCODEs and a status API/facter fact, so failures like the recentinvalid owner name: empty label/ NOTZONE surface directly instead of as opaque nsupdate stderr.Changes
dns-updaterpackage; manage/etc/dns-updater/env.dns-updater.service, restarting only on env/key change — records-file edits are picked up by the daemon`s own inotify watch, so no service churn on record changes.concatrecords file and the TSIG key file unchanged (same paths/format)./usr/local/bin/dns-update+dns-update.path/.serviceunits are absent.dns-update.{sh,service,path}.epptemplates.Sequencing — HOLD
Do not merge until the
dns-updaterRPM is published to artifactapirpm-internal(needs terraform-git#33 to create the repo, then the daemon code pushed + tagged so Woodpecker builds the RPM). Merging before the package exists makespackage { dns-updater }fail on every host.Supersedes the interim shell fix in #481 (which stays valid until this rolls out). Keeps the file as the desired-state interface (puppet owns desired records; the daemon reconciles + reports).
Replaces the profiles::dns::updater shell mechanism (dns-update.sh + dns-update.path/.service + the in-run exec) with the packaged dns-updater daemon, which watches the records file (inotify) and network interfaces and pushes TSIG-signed RFC2136 updates natively. - install the dns-updater package; manage /etc/dns-updater/env - run the packaged dns-updater.service, restarting only on env/key change (records-file edits are picked up by the daemon's own watch, no churn) - keep the concat records file and TSIG key file unchanged - ensure the old script + .path/.service units are absent - drop the now-dead dns-update.{sh,service,path}.epp templates The daemon reports per-zone RCODEs and a health status API, so failures like the recent empty-label/NOTZONE ones surface directly instead of as opaque nsupdate stderr.HOLD lifted —
dns-updaterv0.1.0 is published: RPMdns-updater-0.1.0-1.x86_64.rpmis live in artifactapirpm-internal(HTTP 200), sopackage { dns-updater }will resolve on the hosts. Safe to merge; puppet will install the package, start the daemon, and retire the old script/units. The TSIGclient-updatekey is already managed (nsupdate was already working), so the daemon has what it needs.