benvin
318d30808c
ci/woodpecker/pr/puppet-lint Pipeline was successful
ci/woodpecker/pr/ruby-validate Pipeline was successful
ci/woodpecker/pr/yamllint Pipeline was successful
ci/woodpecker/pr/bolt-validate Pipeline was successful
ci/woodpecker/pr/erb-validate Pipeline was successful
ci/woodpecker/pr/epp-validate Pipeline was successful
ci/woodpecker/pr/puppet-validate Pipeline was successful
ci/woodpecker/pr/ruby-check Pipeline was successful
The halb published service CNAMEs (git.unkin.net, dashboard.ceph.unkin.net, ...)
with a bare target label ("au-syd1-prod-halb-vrrp"). dns-updater parses the
record value with no $ORIGIN, so a bare label becomes root-absolute
("au-syd1-prod-halb-vrrp.") and dead-ends in NXDOMAIN -- breaking every
halb-fronted name once the k8s bind became authoritative.
Emit fully-qualified targets (trailing dot) for both the vrrp and non-vrrp
CNAMEs, matching the FQDN value dns-updater expects:
- au-syd1-prod-halb-vrrp.<domain>. and au-syd1-prod-halb.<domain>.
77 lines
3.0 KiB
Puppet
77 lines
3.0 KiB
Puppet
# profiles::haproxy::dns
|
|
class profiles::haproxy::dns (
|
|
Stdlib::IP::Address $ipaddr,
|
|
Array[Stdlib::Fqdn] $vrrp_cnames = [],
|
|
Array[Stdlib::Fqdn] $cnames = [],
|
|
Integer $order = 10,
|
|
){
|
|
|
|
# create an A record for each load balancer in a region
|
|
$location_environment = "${facts['country']}-${facts['region']}-${facts['environment']}"
|
|
profiles::dns::record { "${facts['networking']['fqdn']}_${location_environment}-halb_A":
|
|
value => $::facts['networking']['ip'],
|
|
type => 'A',
|
|
record => "${location_environment}-halb",
|
|
zone => $::facts['networking']['domain'],
|
|
order => $order,
|
|
}
|
|
|
|
# export cnames for haproxy applications
|
|
$cnames.each |$cname| {
|
|
$parts = split($cname, '\.')
|
|
$domain = join($parts[1, $parts.length], '.')
|
|
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
|
# CNAME target must be a fully-qualified name (trailing dot): dns-updater
|
|
# parses the value with no $ORIGIN, so a bare label becomes root-absolute
|
|
# ("au-syd1-prod-halb.") and dead-ends in NXDOMAIN.
|
|
value => "${location_environment}-halb.${facts['networking']['domain']}.",
|
|
type => 'CNAME',
|
|
record => "${cname}.",
|
|
zone => $domain,
|
|
order => $order,
|
|
}
|
|
}
|
|
|
|
# if it is, find hosts, sort them so they dont cause changes every run
|
|
$servers_array = sort(puppetdb_query(
|
|
"facts[certname] {
|
|
name = 'enc_role' and value = '${facts['enc_role']}' and
|
|
certname in facts[certname] { name = 'country' and value = '${facts['country']}' } and
|
|
certname in facts[certname] { name = 'region' and value = '${facts['region']}' } and
|
|
certname in facts[certname] { name = 'environment' and value = '${facts['environment']}' }
|
|
}"
|
|
).map |$fact| { $fact['certname'] })
|
|
|
|
# give enough time for a few hosts to be provisioned
|
|
if length($servers_array) >= 3 {
|
|
|
|
# if this is the first host in the returned filter, export a/cnames for haproxy applications
|
|
if $servers_array[0] == $trusted['certname'] {
|
|
['main.unkin.net', 'unkin.net'].each |$domain| {
|
|
profiles::dns::record { "${facts['networking']['fqdn']}_vrrp_${domain}_${location_environment}-halb-vrrp":
|
|
value => $ipaddr,
|
|
type => 'A',
|
|
record => "${location_environment}-halb-vrrp",
|
|
zone => $domain,
|
|
order => $order,
|
|
}
|
|
}
|
|
|
|
$vrrp_cnames.each |$cname| {
|
|
$parts = split($cname, '\.')
|
|
$domain = join($parts[1, $parts.length], '.')
|
|
profiles::dns::record { "${::facts['networking']['fqdn']}_${cname}_CNAME":
|
|
# Fully-qualified target (trailing dot); see the note on the non-vrrp
|
|
# cnames above. The matching A record is published in main.unkin.net
|
|
# and unkin.net just above.
|
|
value => "${location_environment}-halb-vrrp.${facts['networking']['domain']}.",
|
|
type => 'CNAME',
|
|
record => "${cname}.",
|
|
zone => $domain,
|
|
order => $order,
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|