opendev/system-config
Code Issues Proposed changes

dns: abstract names

Browse Source 
Switch the DNS testing names to "99" which helps disambiguate testing
from production, and makes you think harder about ensuring references
are abstracted properly.

The LE zone gets installed on the hidden primary, so it should just
use the inventory_hostname rather than hard-coding.  Instead of
hard-coding the secondaries, we grab them from the secondary DNS
group.  This should allow us to start up replacement DNS servers which
will be inactive until they are enabled for the domain.

This requires an update to the LE job, as it currently doesn't have a
secondary nameserver as part of the nodes.  This means the
"adns-secondary" group is blank there.  Even though this node isn't
doing anything, I think it's worth adding to cover this path (I did
consider some sort of dummy host add type thing, but that just makes
things hard to follow).  We also use the 99 suffix in that job just
for consistency.

Change-Id: I1a4be41b70180deab51a3cc8a2b3e83ffd0ff1dc
This commit is contained in:
Ian Wienand 2023-04-17 16:27:56 +10:00
parent 07d453d4e6
commit 0a0ca77f3b
No known key found for this signature in database
5 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
playbooks/roles/install-ansible/files/inventory_plugins/test-fixtures/results.yaml
View File

@ -3,11 +3,11 @@
results:
adns1.opendev.org:
adns99.opendev.org:
- adns
- adns-primary
ns1.opendev.org:
ns99.opendev.org:
- adns
- adns-secondary

7
playbooks/roles/letsencrypt-install-txt-record/templates/zone.db.j2
View File

@ -1,14 +1,15 @@
; -*- mode: zone -*-
$ORIGIN acme.opendev.org.
$TTL 1m
@ IN SOA adns1.opendev.org. hostmaster.opendev.org. (
@ IN SOA {{ inventory_hostname }}. hostmaster.opendev.org. (
{{ lookup('pipe', 'date +%s') }} ; serial number unixtime
1h ; refresh (secondary checks for updates)
10m ; retry (secondary retries failed axfr)
10d ; expire (secondary ends serving old data)
5m ) ; min ttl (cache time for failed lookups)
@ IN NS ns1.opendev.org.
@ IN NS ns2.opendev.org.
{% for ns in groups['adns-secondary'] %}
@ IN NS {{ ns }}.
{% endfor %}
; NOTE: DO NOT HAND EDIT. THESE KEYS ARE MANAGED BY ANSIBLE

2
testinfra/test_adns.py
View File

@ -13,7 +13,7 @@
# under the License.
testinfra_hosts = ['adns1.opendev.org']
testinfra_hosts = ['adns99.opendev.org']
def test_bind(host):

2
testinfra/test_ns.py
View File

@ -13,7 +13,7 @@
# under the License.
testinfra_hosts = ['ns1.opendev.org']
testinfra_hosts = ['ns99.opendev.org']
def test_nsd(host):

12
zuul.d/system-config-run.yaml
View File

@ -225,7 +225,7 @@
name: system-config-run-letsencrypt
parent: system-config-run
description: |
Run the playbook for letsencrypt key acquisition.
Run the playbook for letsencrypt key acquisition
nodeset:
nodes:
- <<: *bridge_node_x86
@ -237,7 +237,9 @@
# it will populate to the test DNS servers. LE won't actually
# authenticate those records, but we are validating the path
# of at least creating and collecting them here.
- name: adns-letsencrypt.opendev.org
- name: adns99.opendev.org
label: ubuntu-jammy
- name: ns99.opendev.org
label: ubuntu-jammy
- name: letsencrypt01.opendev.org
label: ubuntu-jammy
@ -432,9 +434,9 @@
nodeset:
nodes:
- <<: *bridge_node_x86
- name: adns1.opendev.org
- name: adns99.opendev.org
label: ubuntu-jammy
- name: ns1.opendev.org
- name: ns99.opendev.org
label: ubuntu-jammy
groups:
- <<: *bastion_group
@ -442,7 +444,7 @@
run_playbooks:
- playbooks/service-nameserver.yaml
host-vars:
adns1.opendev.org:
adns99.opendev.org:
host_copy_output:
'/etc/bind/named.conf': logs
'/var/lib/bind/zones': logs