unkinben
0de3ac2a0b
## Why 6 hosts (ausyd1nxvm2069-2073, 2098) ended up with a reverse PTR in bind-authoritative but **no forward A record**, and the `unkin.net` service records (git/grafana/auth/fafflix, all published by the halb host 2069) never landed at all. VictoriaLogs (`dns-update-apply` on 2069 & 2070) shows the cause: ``` dns-update: nsupdate to 198.18.200.9 failed invalid owner name: empty label syntax error ``` `profiles::dns::record` publishes some records whose name is already fully-qualified (trailing dot) — e.g. `au-syd1-pve.main.unkin.net.`, `cobbler.main.unkin.net.`, `dashboard.ceph.unkin.net.`, and the halb CNAMEs. The `dns-update` script `fqdn()` unconditionally appended the zone, producing `…net..main.unkin.net.` — the `..` is an empty label, which nsupdate rejects, failing the entire per-zone `send`. The reverse-PTR send is sorted first and its name is always relative, so it still applied — hence "PTR but no A". ## Change `fqdn()` now handles three cases: - `@`/empty → zone apex (unchanged) - name ending in `.` → already FQDN, used verbatim (**the fix**) - otherwise → relative, append `.zone.` (unchanged) Verified against all record shapes (relative host, apex, FQDN CNAME, reverse label) — no more `..`. ## After merge Once puppet re-runs on the affected hosts their `main.unkin.net`/`unkin.net` updates succeed, filling in the missing A records and the `unkin.net` service zone. Pairs with argocd-apps#260 (adds the `ceph.unkin.net` zone so `dashboard.ceph.unkin.net` does not then hit NOTZONE). Reviewed-on: #481 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
65 lines
2.3 KiB
Plaintext
65 lines
2.3 KiB
Plaintext
<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
|
|
#!/bin/bash
|
|
# Managed by puppet (profiles::dns::updater). Applies this host's records to the
|
|
# authoritative DNS server via TSIG nsupdate. Only the delta since the last
|
|
# successful run is sent; removed records are deleted.
|
|
set -euo pipefail
|
|
|
|
SERVER="<%= $server %>"
|
|
KEYFILE="<%= $key_file %>"
|
|
RECORDS="<%= $records_file %>"
|
|
STATE="<%= $state_file %>"
|
|
|
|
[ -f "$RECORDS" ] || exit 0
|
|
touch "$STATE"
|
|
|
|
# Format per line: zone|name|type|ttl|value (name is relative to zone, or @).
|
|
desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
|
|
applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
|
|
|
|
[ "$desired" = "$applied" ] && exit 0
|
|
|
|
fqdn() { # name zone
|
|
# $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
|
|
# (trailing dot). Only append the zone in the relative case; appending it to
|
|
# an already-qualified name yields a "..", which nsupdate rejects as an
|
|
# "invalid owner name: empty label".
|
|
case "$1" in
|
|
''|'@') printf '%s.' "$2" ;;
|
|
*.) printf '%s' "$1" ;;
|
|
*) printf '%s.%s.' "$1" "$2" ;;
|
|
esac
|
|
}
|
|
|
|
msg="$(mktemp)"
|
|
trap 'rm -f "$msg"' EXIT
|
|
printf 'server %s\n' "$SERVER" >> "$msg"
|
|
|
|
# Process per zone so each UPDATE message targets a single zone.
|
|
zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
|
|
for zone in $zones; do
|
|
printf 'zone %s.\n' "$zone" >> "$msg"
|
|
# Additions/updates: replace the RRset for every desired record in this zone.
|
|
printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
|
|
printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
|
|
done
|
|
# Deletions: records present last run but gone now.
|
|
comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
|
|
awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
|
|
done
|
|
printf 'send\n' >> "$msg"
|
|
done
|
|
|
|
if nsupdate -k "$KEYFILE" "$msg"; then
|
|
printf '%s\n' "$desired" > "$STATE"
|
|
else
|
|
echo "dns-update: nsupdate to ${SERVER} failed" >&2
|
|
exit 1
|
|
fi
|