openstack/puppet-designate
Code Issues Proposed changes

Fix setup of bind9 backend

Browse Source 
Designate no longer uses the parameters in the [backend:bind9] section,
since ppols.yaml was introduced. This change ensures the parameters in
this wrong section are purged.

Also, this change introduces support for setting up backend using
pools.yaml according to the current installation guide.

Closes-Bug: #1961516
Change-Id: I28a91ab99325970db1e96aa904f35e8f9a5e109c
This commit is contained in:
Takashi Kajinami 2022-02-20 17:41:59 +09:00
parent ec8079de90
commit 22019e46e2
4 changed files with 172 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
manifests/backend/bind9.pp
View File

@ -5,37 +5,76 @@
# == Parameters
#
# [*rndc_config_file*]
# (optional) Location of the rndc configuration file.
# Defaults to '/etc/rndc.conf'
# (Optional) Location of the rndc configuration file.
# Defaults to '/etc/rndc.conf'
#
# [*rndc_key_file*]
# (optional) Location of the rndc key file.
# (Optional) Location of the rndc key file.
# Defaults to '/etc/rndc.key'
#
# [*rndc_host*]
# (optional) Host running DNS service.
# Defaults to '127.0.0.1'
#
# [*rndc_port*]
# (optional) Port to use for dns service on rndc_host.
# Defaults to '953'
# (Optional) RNDC Port.
# Defaults to 953.
#
# [*rndc_controls*]
# (optional) Hash defining controls configuration for rndc.
# (Optional) Hash defining controls configuration for rndc.
# Defaults to undef, which uses the puppet-dns default
#
# [*ns_records*]
# (Optional) List of the NS records for zones hosted within this pool. This
# parameter takes hash value of <priority>:<host> mapping.
# Defaults to {1 => 'ns1.example.org.'}
#
# [*nameservers*]
# (Optional) List out the nameservers for this pool.
# Defaults to ['127.0.0,1'].
#
# [*bind9_hosts*]
# (Optional) Host running DNS service.
# Defaults to ['127.0.0,1'].
#
# [*dns_port*]
# (Optional) TCP port to connect to DNS service.
# Defaults to 53.
#
# [*mdns_hosts*]
# (Optional) Array of hosts where designate-mdns service is running.
# Defaults to ['127.0.0.1'].
#
# [*mdns_port*]
# (Optional) TCP Port to connect to designate-mdns service.
# Defaults to 5354.
#
# [*configure_bind*]
# (optional) Enables running named configuration for hosts where designate and
# designate bind services are collocated.
# (Optional) Enables running bind9/named configuration for hosts where
# designate and designate bind services are collocated.
# Defaults to true
#
# [*manage_pool*]
# (Optional) Manage pools.yaml and update pools by designate-manage command
# Defaults to false
#
# DEPRECATED PARAMETERS
#
# [*rndc_host*]
# (Optional) RNDC Host
# Defaults to undef
#
class designate::backend::bind9 (
$rndc_host = '127.0.0.1',
$rndc_port = '953',
$rndc_config_file = '/etc/rndc.conf',
$rndc_key_file = '/etc/rndc.key',
$rndc_controls = undef,
$configure_bind = true,
$rndc_config_file = '/etc/rndc.conf',
$rndc_key_file = '/etc/rndc.key',
$rndc_controls = undef,
$rndc_port = 953,
$ns_records = {1 => 'ns1.example.org.'},
$nameservers = ['127.0.0.1'],
$bind9_hosts = ['127.0.0.1'],
$dns_port = 5322,
$mdns_hosts = ['127.0.0.1'],
$mdns_port = 5354,
$configure_bind = true,
$manage_pool = false,
# DEPRECATED PARAMETERS
$rndc_host = undef,
) {
include designate::deps
@ -56,7 +95,7 @@ class designate::backend::bind9 (
# Recommended by Designate docs as a mitigation for potential cache
# poisoning attacks:
# https://docs.openstack.org/designate/queens/admin/production-guidelines.html#bind9-mitigation
# https://docs.openstack.org/designate/latest/admin/production-guidelines.html#bind9-mitigation
concat::fragment { 'dns minimal-responses':
target => $::dns::optionspath,
content => 'minimal-responses yes;',
@ -75,11 +114,38 @@ class designate::backend::bind9 (
})
}
designate_config {
'backend:bind9/rndc_host' : value => $rndc_host;
'backend:bind9/rndc_port' : value => $rndc_port;
'backend:bind9/rndc_config_file' : value => $rndc_config_file;
'backend:bind9/rndc_key_file' : value => $rndc_key_file;
# TODO(tkajinam): Remove this after Yoga release.
if $rndc_host != undef {
warning('The rndc_host parameter is deprecated and has no effect.')
}
# TODO(tkajinam): Remove this after Yoga release.
designate_config {
'backend:bind9/rndc_host' : ensure => absent;
'backend:bind9/rndc_port' : ensure => absent;
'backend:bind9/rndc_config_file' : ensure => absent;
'backend:bind9/rndc_key_file' : ensure => absent;
}
if $manage_pool {
file { '/etc/designate/pools.yaml':
ensure => present,
path => '/etc/designate/pools.yaml',
owner => $designate::params::user,
group => $designate::params::group,
mode => '0640',
content => template('designate/bind9-pools.yaml.erb'),
require => Anchor['designate::config::begin'],
before => Anchor['designate::config::end'],
}
exec { 'designate-manage pool update':
command => 'designate-manage pool update',
path => '/usr/bin',
user => $designate::params::user,
refreshonly => true,
require => Anchor['designate::service::end'],
subscribe => File['/etc/designate/pools.yaml'],
}
}
}

17
releasenotes/notes/bug-1961516-0634fabec06a4e94.yaml Normal file
View File

@ -0,0 +1,17 @@
---
features:
- |
Now the ``designate::backend::bind9`` class supports setting up bind9
backend using ``/etc/designate/pools.yaml`` properly. This feature can be
enabled by the new ``manage_pool`` parameter.
deprecations:
- |
The ``designate::backend::bind9::rndc_host`` parameter has been deprecated
and has no effect now.
fixes:
- |
The ``designate::backend::bind9`` class no longer configures parameters
in the ``[backend:bind9]`` section, as these parameters are no longer
effective.

61
spec/classes/designate_backend_bind9_spec.rb
View File

@ -7,53 +7,50 @@ describe 'designate::backend::bind9' do
shared_examples 'designate-backend-bind9' do
context 'with default params' do
it 'configures designate backend bind9 with default parameters' do
is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value('127.0.0.1')
is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value('953')
is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value('/etc/rndc.conf')
is_expected.to contain_designate_config('backend:bind9/rndc_key_file').with_value('/etc/rndc.key')
# TODO(tkajinam): remove this once we update the default value
let :params do
{ :manage_pool => true }
end
it 'configures named and pool' do
is_expected.to contain_concat_fragment('dns allow-new-zones').with(
:target => platform_params[:dns_optionspath],
:content => 'allow-new-zones yes;')
:content => 'allow-new-zones yes;'
)
is_expected.to contain_file('/etc/designate/pools.yaml').with(
:ensure => 'present',
:path => '/etc/designate/pools.yaml',
:owner => 'designate',
:group => 'designate',
:mode => '0640',
)
is_expected.to contain_exec('designate-manage pool update').with(
:command => 'designate-manage pool update',
:path => '/usr/bin',
:user => 'designate',
:refreshonly => true,
)
end
end
context 'with named configuration disabled ' do
context 'with named configuration disabled' do
let :params do
{ :configure_bind => false }
end
it 'configures designate backend bind9 with default parameters' do
is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value('127.0.0.1')
is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value('953')
is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value('/etc/rndc.conf')
is_expected.to contain_designate_config('backend:bind9/rndc_key_file').with_value('/etc/rndc.key')
it 'does not configure named' do
is_expected.not_to contain_concat_fragment('dns allow-new-zones')
end
end
context 'when overriding rndc_config_file' do
context 'with pool management disabled' do
let :params do
{ :rndc_config_file => '/srv/designate/rndc.conf' }
{ :manage_pool => false }
end
it 'configures designate bind9 backend with custom rndc_config_file' do
is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value(params[:rndc_config_file])
it 'does not configure pool' do
is_expected.to_not contain_file('/etc/designate/pools.yaml')
is_expected.to_not contain_exec('designate-manage pool update')
end
end
context 'when overriding rndc_host and rndc_port' do
let :params do
{
:rndc_host => '10.0.0.42',
:rndc_port => '1337'
}
end
it 'configures designate bind9 backend with custom rndc_port and rndc_host' do
is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value(params[:rndc_port])
is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value(params[:rndc_host])
end
end
end
on_supported_os({
@ -70,11 +67,11 @@ describe 'designate::backend::bind9' do
case facts[:osfamily]
when 'Debian'
{
:dns_optionspath => '/etc/bind/named.conf.options'
:dns_optionspath => '/etc/bind/named.conf.options'
}
when 'RedHat'
{
:dns_optionspath => '/etc/named/options.conf'
:dns_optionspath => '/etc/named/options.conf'
}
end
end

36
templates/bind9-pools.yaml.erb Normal file
View File

@ -0,0 +1,36 @@
---
- name: default
description: Default pool
attributes: {}
ns_records:
<% @ns_records.sort.each do |priority, hostname| -%>
- hostname: <%= hostname %>
priority: <%= priority.to_s %>
<% end -%>
nameservers:
<% @nameservers.each do |nameserver| -%>
- host: <%= nameserver %>
port: <%= @dns_port.to_s %>
<% end -%>
targets:
<% @bind9_hosts.each do |bind9_host| -%>
- type: bind9
description: BIND9 Server <%= bind9_host %>
masters:
<% @mdns_hosts.each do |mdns_host| -%>
- host: <%= mdns_host %>
port: <%= @mdns_port.to_s %>
<% end -%>
options:
host: <%= bind9_host %>
port: <%= @dns_port.to_s %>
rndc_host: <%= bind9_host %>
rndc_port: <%= @rndc_port %>
rndc_config_file: <%= @rndc_config_file %>
rndc_key_file: <%= @rndc_key_file %>
<% end -%>