Merge "Use ansible to generate bind pool configuration"

releasenotes/notes/add_designate_bind_pool_config-1eda0fd001af1308.yaml

@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Added new role ``designate_bind_pool`` to generate a bind pool configuration
+    using information from the existing deployment.

tripleo_ansible/roles/designate_bind_pool/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+designate_pool_config_file_path: '/var/lib/config-data/puppet-generated/designate/etc/designate/pools.yaml'
+designate_bind_pool_key_file_path: '/var/lib/config-data/puppet-generated/designate/etc/designate/private'
+pool_zone_domain: 'example.org'

tripleo_ansible/roles/designate_bind_pool/meta/main.yml

@@ -0,0 +1,42 @@
+---
+# Copyright 2021 Red Hat, Inc.
+# All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+galaxy_info:
+  author: OpenStack
+  description: TripleO OpenStack Role -- designate_bind_pool
+  company: Red Hat
+  license: Apache-2.0
+  min_ansible_version: 2.7
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  platforms:
+    - name: CentOS
+      versions:
+        - 7
+        - 8
+
+  galaxy_tags:
+    - tripleo
+
+
+# List your role dependencies here, one per line. Be sure to remove the '[]' above,
+# if you add dependencies to this list.
+# dependencies:

tripleo_ansible/roles/designate_bind_pool/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+# XXX (beagles) which permissions?
+- name: create bind pool configuration for designate
+  become: true
+  template:
+      src: pools.yaml.j2
+      dest: "{{ designate_pool_config_file_path }}"
+
+- name: ensure rndc key path exists
+  become: true
+  file:
+      path: "{{ designate_bind_pool_key_file_path }}"
+      state: directory
+
+- name: create rndc key files for each bind instance
+  become: true
+  template:
+      src: rndc.key.j2
+      dest: "{{ designate_bind_pool_key_file_path }}/bind{{ item.0|int + 1 }}.key"
+  with_indexed_items: "{{ designate_bind_node_ips  }}"

tripleo_ansible/roles/designate_bind_pool/templates/pools.yaml.j2

@@ -0,0 +1,55 @@
+- name: default
+  # The name is immutable. There will be no option to change the name after
+  # creation and the only way will to change it will be to delete it
+  # (and all zones associated with it) and recreate it.
+  description: Default Pool
+
+  attributes: {}
+
+  # List out the NS records for zones hosted within this pool
+  # This should be a record that is created outside of designate, that
+  # points to the public IP of the controller node.
+  ns_records:
+    {% for nameserver in designate_bind_node_ips -%}
+    - hostname: ns{{ loop.index }}.{{ pool_zone_domain }}.
+      priority: {{ loop.index }}
+    {% endfor %}
+
+  # List out the nameservers for this pool. These are the actual BIND servers.
+  # We use these to verify changes have propagated to all nameservers.
+  nameservers:
+    {% for nameserver in designate_bind_node_ips -%}
+    - host: {{ nameserver }}
+      port: 53
+    {% endfor %}
+
+  # List out the targets for this pool. For BIND there will be one
+  # entry for each BIND server, as we have to run rndc command on each server
+  targets:
+    {% for server in designate_bind_node_ips -%}
+    - type: bind9
+      description: BIND9 Server {{ loop.index }}
+
+      # List out the designate-mdns servers from which BIND servers should
+      # request zone transfers (AXFRs) from.
+      # This should be the IP of the controller node.
+      # If you have multiple controllers you can add multiple masters
+      # by running designate-mdns on them, and adding them here.
+      # XXX(beagles): these are just internal API atm but there really needs to
+      # be a public VIP endpoint for each and will be addressed in a followup
+      # patch.
+      masters:
+        {% for minidns_server in designate_mdns_node_ips -%}
+        - host: {{ minidns_server }}
+          port: 5354
+        {% endfor %}
+
+      # BIND Configuration options
+      options:
+        host: {{ server }}
+        port: 53
+        rndc_host: {{ server }}
+        rndc_port:  953
+        rndc_key_file: {{ keyfile_base_path|default('/etc/designate/private/bind') }}{{ loop.index }}.key
+
+    {% endfor %}

tripleo_ansible/roles/designate_bind_pool/templates/rndc.key.j2

@@ -0,0 +1,4 @@
+key "rndc-key" {
+        algorithm hmac-sha256;
+        secret "{{ designate_rndc_key }}";
+};