nameserver: Support dynamic DNS in named config

Signed-off-by: David Galloway <dgallowa@redhat.com>

diff --git a/roles/nameserver/README.rst b/roles/nameserver/README.rst
index 3c403eac1b50c00d1b5df48485d189e83776943b..63f1b539e19615a7d73488365f6a9f7255e5c910 100644 (file)
--- a/roles/nameserver/README.rst
+++ b/roles/nameserver/README.rst
@@ -71,6 +71,9 @@ Most variables are defined in ``roles/nameserver/defaults/main.yml`` and values
 |                                                        |                                                                                                                           |
 |                                                        |**NOTE:** Setting to "yes" will add ``allow-recursion { any; }``. See To-Do.                                               |
 +--------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------+
+|``ddns_keys: {}``                                       |A dictionary defining each Dynamic DNS zone's authorized key.  See **Dynamic DNS** below.  Defined in an encrypted file in |
+|                                                        |the secrets repo                                                                                                           |
++--------------------------------------------------------+---------------------------------------------------------------------------------------------------------------------------+
 
 **named_domains: []**
 
@@ -129,6 +132,7 @@ The ``named_domains`` dictionary is the bread and butter of creating zone files.
       ddns.example.com:
         ipvar: NULL
         dynamic: true
+        forward: ddns.example.com
         
 Inventory
 +++++++++
@@ -146,6 +150,54 @@ Using the ``named_domains`` example above and inventory below, forward *and reve
 
 **Note:** Hosts in inventory with no IP address defined will not have records created and should be added to ``miscrecords`` in ``named_domains``.
 
+Dynamic DNS
++++++++++++
+If you wish to use the Dynamic DNS feature of this role, you should generate an HMAC-MD5 keypair using dnssec-keygen_ for each zone you want to be able to dynamically update.  The key generated should be pasted in the ``secret`` value of the ``ddns_keys`` dictionary for the corresponding domain.
+
+**Example**::
+
+    $ dnssec-keygen -a HMAC-MD5 -b 512 -n USER ddns.example.com
+    Kddns.example.com.+157+57501
+    $ cat Kddns.example.com.+157+57501.key
+    ddns.example.com. IN KEY 0 3 157 LxFSAiBgKYtsTTV/hjaK7LNdsbk19xQv0ZY9xLtrpdIWhf2S4gurD5GJ JjP9N8bnlCPKc7zVy+JcBYbSMSsm2A==
+
+    # In {{ secrets_path }}/nameserver.yml
+    ---
+    ddns_keys:
+      ddns.example.com:
+        secret: "LxFSAiBgKYtsTTV/hjaK7LNdsbk19xQv0ZY9xLtrpdIWhf2S4gurD5GJ JjP9N8bnlCPKc7zVy+JcBYbSMSsm2A=="
+
+``roles/nameserver/templates/named.conf.j2`` loops through each domain in ``named_domains``, checks whether ``dynamic: true`` and if so, then loops through ``ddns_keys`` and matches the secret key to the domain.
+
+These instructions assume you'll either have one host updating DNS records or you'll be sharing the resulting key.  Clients can use nsupdate_ to update the nameserver.  Configuring that is outside the scope of this role.
+
+You can have two types of Dynamic DNS zones:
+
+  1. A pure dynamic DNS zone with no static A records
+  2. A mixed zone consisting of both dynamic and static records
+
+For a mixed zone, you must specify ``ddns_hostname_prefixes`` under the domain in ``named_domains`` else your dynamic records will be overwritten each time the records task is run.  **Example**::
+
+    named_domains:
+      private.example.com:
+        forward: private.example.com
+        ipvar: ip
+        dynamic: true
+        ddns_hostname_prefixes:
+          - foo
+      ddns.example.com:
+        forward: ddns.example.com
+        ipvar: NULL
+        dynamic: true
+
+In the example above, a dynamic hostname of ``foo001.private.example.com`` will be saved and restored at the end of the records task.  If you *dynamically* added a hostname of ``bar001.private.example.com`` however, the records task will remove it.  Do not create static hostnames in your ansible inventory using any of the prefixes in ``ddns_hostname_prefixes`` or you'll end up with duplicates in the zone file.
+
+The records task will not modify the ddns.example.com zone file.
+
+For our upstream test lab's purposes, this allows us to combine static and dynamic records in our ``front.sepia.ceph.com`` domain so teuthology_'s ``lab_domain`` variable can remain unchanged.
+
+**NOTE:** Reverse zone Dynamic DNS is not supported at this time.
+
 Tags
 ++++
 
@@ -177,7 +229,9 @@ To-Do
 
 - Allow additional user-defined firewall rules
 - DNSSEC
-- Dynamic DNS
 - Add support for specifying networks to allow recursion from
 
 .. _Sepia: https://ceph.github.io/sepia/
+.. _dnssec-keygen: https://ftp.isc.org/isc/bind9/cur/9.9/doc/arm/man.dnssec-keygen.html
+.. _nsupdate: https://linux.die.net/man/8/nsupdate
+.. _teuthology: http://docs.ceph.com/teuthology/docs/siteconfig.html?highlight=lab_domain

diff --git a/roles/nameserver/defaults/main.yml b/roles/nameserver/defaults/main.yml
index 64f797e788511f61197c0fb07a58986a33843af8..c4dc0a5f556e3d67d4e68a253920c58ced2c4634 100644 (file)
--- a/roles/nameserver/defaults/main.yml
+++ b/roles/nameserver/defaults/main.yml
@@ -23,3 +23,5 @@ named_conf_soa_ttl: 3600
 named_conf_soa_refresh: 3600
 named_conf_soa_retry: 3600
 named_conf_soa_expire: 604800
+
+ddns_keys: {}

diff --git a/roles/nameserver/tasks/config.yml b/roles/nameserver/tasks/config.yml
index 8de15301dcde9088e400ec0765652ed36f63a1dc..b3171fc86eb16ba055eb5a6c1217f9606d557586 100644 (file)
--- a/roles/nameserver/tasks/config.yml
+++ b/roles/nameserver/tasks/config.yml
@@ -10,7 +10,6 @@
     dest: "{{ named_conf_file }}"
     validate: named-checkconf %s
   notify: restart named
-  with_dict: "{{ named_domains }}"
 
 - name: Apply named daemon options
   lineinfile:

diff --git a/roles/nameserver/tasks/main.yml b/roles/nameserver/tasks/main.yml
index 5a59d54b3dbfc9c1b17617f178258cbf9f0cbf0c..87fbdb89dcd2cb05de1889806e8d9bfb3eab2a9c 100644 (file)
--- a/roles/nameserver/tasks/main.yml
+++ b/roles/nameserver/tasks/main.yml
@@ -1,4 +1,10 @@
 ---
+- name: Include secrets
+  include_vars: "{{ secrets_path | mandatory }}/nameserver.yml"
+  no_log: true
+  tags:
+    - always
+
 # Install and update system packages
 - include: packages.yml
   tags:

diff --git a/roles/nameserver/templates/named.conf.j2 b/roles/nameserver/templates/named.conf.j2
index cd7ac2d1b8988955c5ddb7acf33c8eec20ffda1c..5b17d8152ea7daca2aa8a689de0d8367cb00ebd7 100644 (file)
--- a/roles/nameserver/templates/named.conf.j2
+++ b/roles/nameserver/templates/named.conf.j2
@@ -24,11 +24,28 @@ logging {
         };
 };
 
+# Dynamic DNS
+{% for key, zone in named_domains.iteritems() %}
+{% if zone.dynamic == true %}
+{% for domain, values in ddns_keys.iteritems() %}
+{% if key == domain %}
+key "{{ key }}" {
+       algorithm hmac-md5;
+       secret "{{ values.secret }}";
+};
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endfor %}
+
 # Forward zones
 {% for key, zone in named_domains.iteritems() %}
 zone "{{ key }}" {
        type    master;
        file    "{{ named_conf_zones_path }}/{{ key }}";
+{% if zone.dynamic == true %}
+       allow-update { key "{{ key }}"; };
+{% endif %}
 };
 
 {% endfor %}