unkinben
88fcb97ad1
Replaces the exported-resources → puppet DNS master zone-file flow with per-host RFC2136 dynamic updates against the k8s **bind-authoritative** write endpoint (198.18.200.9). The master no longer manages zone files. ## Design Each node assembles its DNS records into a local concat file; a systemd `.path` unit watches it and runs `dns-update` (nsupdate) on change — exactly the watch-a-file model requested. ## Changes - **profiles::dns::updater** (new): concat records file + TSIG key file + `dns-update` script + `dns-update.service` (oneshot) + `dns-update.path` (watcher). The script sends only the delta since last run and deletes removed records, grouped per zone. - **profiles::dns::record**: writes a local concat fragment (`zone|name|type|ttl|value`) instead of exporting `@@concat::fragment` to the master. - **profiles::dns::base**: includes `profiles::dns::updater` (all nodes). - **hiera**: `profiles::dns::updater` server/key_name/algorithm in common.yaml. ## Inert until keyed The updater does nothing until `profiles::dns::updater::key_secret` (TSIG) is set in eyaml — records are assembled but not applied, so nodes are safe before the key exists. ## Prerequisites (k8s side, separate) 1. The `bind-authoritative` zones must set `dynamicUpdate: true` + an `updateKeyRef` (a client-update BindTSIGKey) so they accept these updates. 2. The TSIG key must be shared: the operator-generated key value goes into eyaml here (or the planned Vault-sync feature bridges it). ## Validated puppet parser/epp validate, puppet-lint, and a functional test of the generated per-zone nsupdate message (replace + delete-removed). Reviewed-on: #475 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
57 lines
2.0 KiB
Plaintext
57 lines
2.0 KiB
Plaintext
<%- | String $server, String $key_file, String $records_file, String $state_file | -%>
|
|
#!/bin/bash
|
|
# Managed by puppet (profiles::dns::updater). Applies this host's records to the
|
|
# authoritative DNS server via TSIG nsupdate. Only the delta since the last
|
|
# successful run is sent; removed records are deleted.
|
|
set -euo pipefail
|
|
|
|
SERVER="<%= $server %>"
|
|
KEYFILE="<%= $key_file %>"
|
|
RECORDS="<%= $records_file %>"
|
|
STATE="<%= $state_file %>"
|
|
|
|
[ -f "$RECORDS" ] || exit 0
|
|
touch "$STATE"
|
|
|
|
# Format per line: zone|name|type|ttl|value (name is relative to zone, or @).
|
|
desired="$(grep -vE '^[[:space:]]*(#|$)' "$RECORDS" | sort -u || true)"
|
|
applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)"
|
|
|
|
[ "$desired" = "$applied" ] && exit 0
|
|
|
|
fqdn() { # name zone
|
|
if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
|
|
}
|
|
|
|
msg="$(mktemp)"
|
|
trap 'rm -f "$msg"' EXIT
|
|
printf 'server %s\n' "$SERVER" >> "$msg"
|
|
|
|
# Process per zone so each UPDATE message targets a single zone.
|
|
zones="$(printf '%s\n%s\n' "$desired" "$applied" | cut -d'|' -f1 | sort -u | grep -v '^$' || true)"
|
|
for zone in $zones; do
|
|
printf 'zone %s.\n' "$zone" >> "$msg"
|
|
# Additions/updates: replace the RRset for every desired record in this zone.
|
|
printf '%s\n' "$desired" | awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s\n' "$f" "$type" >> "$msg"
|
|
printf 'update add %s %s %s %s\n' "$f" "$ttl" "$type" "$value" >> "$msg"
|
|
done
|
|
# Deletions: records present last run but gone now.
|
|
comm -23 <(printf '%s\n' "$applied") <(printf '%s\n' "$desired") | \
|
|
awk -F'|' -v z="$zone" 'NF>=5 && $1==z' | \
|
|
while IFS='|' read -r z name type ttl value; do
|
|
f="$(fqdn "$name" "$z")"
|
|
printf 'update delete %s %s %s\n' "$f" "$type" "$value" >> "$msg"
|
|
done
|
|
printf 'send\n' >> "$msg"
|
|
done
|
|
|
|
if nsupdate -k "$KEYFILE" "$msg"; then
|
|
printf '%s\n' "$desired" > "$STATE"
|
|
else
|
|
echo "dns-update: nsupdate to ${SERVER} failed" >&2
|
|
exit 1
|
|
fi
|