unkinben
225bdc6020
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
Publish records both ways during the k8s cutover, and expose expected vs deployed records for drift detection. - profiles::dns::updater + ::record: manage_nsupdate and manage_export booleans (both default on); export keeps the legacy master flow, so disable it once k8s is authoritative - dns_records fact: parses the expected records file and digs the authoritative server for each, reporting expected / in_sync / drift (plus dns_records_insync boolean); updater writes the server address to /var/lib/dns-updater/server for the fact - hiera: manage_export/manage_nsupdate = true (cutover)
128 lines
4.3 KiB
Puppet
128 lines
4.3 KiB
Puppet
# profiles::dns::updater
|
|
#
|
|
# Publishes this host's DNS records. Two methods, independently toggled so both
|
|
# can run during the k8s cutover (profiles::dns::record honours the same flags):
|
|
#
|
|
# - nsupdate ($manage_nsupdate): assemble the records into a local file and
|
|
# nsupdate them to the k8s authoritative write endpoint via a systemd .path
|
|
# unit that watches the file. Inert until $key_secret (TSIG) is set.
|
|
# - export ($manage_export): the legacy exported-resources flow to the puppet
|
|
# DNS master. Kept during cutover; disable once k8s is authoritative.
|
|
#
|
|
# nsupdate comes from bind-utils (installed via bind::updater in
|
|
# profiles::dns::base).
|
|
class profiles::dns::updater (
|
|
Boolean $manage_nsupdate = true,
|
|
Boolean $manage_export = true,
|
|
String $server = '198.18.200.9',
|
|
String $key_name = 'client-update',
|
|
String $key_algorithm = 'hmac-sha256',
|
|
Optional[Sensitive[String]] $key_secret = undef,
|
|
Integer $default_ttl = 300,
|
|
Stdlib::AbsolutePath $records_file = '/var/lib/dns-updater/records',
|
|
Stdlib::AbsolutePath $state_dir = '/var/lib/dns-updater',
|
|
Stdlib::AbsolutePath $config_dir = '/etc/dns-updater',
|
|
Stdlib::AbsolutePath $master_basedir = lookup('profiles::dns::master::basedir'),
|
|
) {
|
|
|
|
$state_file = "${state_dir}/applied"
|
|
$server_file = "${state_dir}/server"
|
|
$key_file = "${config_dir}/key"
|
|
|
|
if $manage_nsupdate {
|
|
|
|
file { $state_dir:
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0755',
|
|
}
|
|
|
|
# Server address, read by the dns_records fact for drift detection.
|
|
file { $server_file:
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => "${server}\n",
|
|
require => File[$state_dir],
|
|
}
|
|
|
|
# Records file, assembled from profiles::dns::record fragments.
|
|
concat { $records_file:
|
|
ensure => present,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
ensure_newline => true,
|
|
warn => false,
|
|
require => File[$state_dir],
|
|
}
|
|
|
|
concat::fragment { 'dns-update-header':
|
|
target => $records_file,
|
|
content => "# Managed by puppet (profiles::dns::record): zone|name|type|ttl|value\n",
|
|
order => '00',
|
|
}
|
|
|
|
if $key_secret =~ Undef {
|
|
notify { 'dns-updater-inert':
|
|
message => 'profiles::dns::updater: key_secret unset; records assembled but not applied.',
|
|
loglevel => 'info',
|
|
}
|
|
} else {
|
|
file { $config_dir:
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0700',
|
|
}
|
|
|
|
file { $key_file:
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0600',
|
|
show_diff => false,
|
|
content => Sensitive(epp('profiles/dns/tsig-key.epp', {
|
|
'name' => $key_name,
|
|
'algorithm' => $key_algorithm,
|
|
'secret' => $key_secret.unwrap,
|
|
})),
|
|
}
|
|
|
|
file { '/usr/local/bin/dns-update':
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0755',
|
|
content => epp('profiles/dns/dns-update.sh.epp', {
|
|
'server' => $server,
|
|
'key_file' => $key_file,
|
|
'records_file' => $records_file,
|
|
'state_file' => $state_file,
|
|
}),
|
|
}
|
|
|
|
systemd::unit_file { 'dns-update.service':
|
|
content => epp('profiles/dns/dns-update.service.epp', { 'script' => '/usr/local/bin/dns-update' }),
|
|
}
|
|
|
|
# The .path unit watches the records file and triggers the service.
|
|
systemd::unit_file { 'dns-update.path':
|
|
content => epp('profiles/dns/dns-update.path.epp', { 'records_file' => $records_file }),
|
|
active => true,
|
|
enable => true,
|
|
}
|
|
|
|
# Also apply within the puppet run whenever the records change.
|
|
exec { 'dns-update-apply':
|
|
command => '/usr/local/bin/dns-update',
|
|
refreshonly => true,
|
|
subscribe => Concat[$records_file],
|
|
require => [File['/usr/local/bin/dns-update'], File[$key_file]],
|
|
}
|
|
}
|
|
}
|
|
}
|