c5dc8ef19a
For security, it is best to split authoritative and recursive nameservers. This way a security vulnerability that only affects one type of server won't provide an exploit for the other too. For Designate, the managed BIND server is the authoritative one. We can use Neutron's internal DNS server as the recursive server, or users can point at their DNS server of choice. To make sure our defaults work out of the box, this change enables the Neutron internal DNS by default and users can change that if they choose. Since that means we no longer need recursion in BIND, we should shut it off, which this also does. Change-Id: I4193436fdfd05bfd641fc32b58cc9bff24310a80
99 lines
3.0 KiB
YAML
99 lines
3.0 KiB
YAML
heat_template_version: rocky
|
|
|
|
description: >
|
|
OpenStack Designate Worker service configured with Puppet
|
|
parameters:
|
|
ServiceData:
|
|
default: {}
|
|
description: Dictionary packing service data
|
|
type: json
|
|
ServiceNetMap:
|
|
default: {}
|
|
description: Mapping of service_name -> network name. Typically set
|
|
via parameter_defaults in the resource registry. This
|
|
mapping overrides those in ServiceNetMapDefaults.
|
|
type: json
|
|
DefaultPasswords:
|
|
default: {}
|
|
type: json
|
|
RoleName:
|
|
default: ''
|
|
description: Role name on which the service is applied
|
|
type: string
|
|
RoleParameters:
|
|
default: {}
|
|
description: Parameters specific to the role
|
|
type: json
|
|
EndpointMap:
|
|
default: {}
|
|
description: Mapping of service endpoint -> protocol. Typically set
|
|
via parameter_defaults in the resource registry.
|
|
type: json
|
|
MonitoringSubscriptionDesignateWorker:
|
|
default: 'overcloud-designate-worker'
|
|
type: string
|
|
DesignateWorkerLoggingSource:
|
|
type: json
|
|
default:
|
|
tag: openstack.designate.worker
|
|
path: /var/log/designate/designate-worker.log
|
|
DesignateWorkers:
|
|
default: 0
|
|
description: Number of workers for Designate services.
|
|
type: number
|
|
|
|
conditions:
|
|
designate_workers_zero: {equals : [{get_param: DesignateWorkers}, 0]}
|
|
|
|
resources:
|
|
DesignateBase:
|
|
type: ./designate-base.yaml
|
|
properties:
|
|
ServiceData: {get_param: ServiceData}
|
|
ServiceNetMap: {get_param: ServiceNetMap}
|
|
DefaultPasswords: {get_param: DefaultPasswords}
|
|
EndpointMap: {get_param: EndpointMap}
|
|
RoleName: {get_param: RoleName}
|
|
RoleParameters: {get_param: RoleParameters}
|
|
|
|
outputs:
|
|
role_data:
|
|
description: Role data for the Designate Worker service.
|
|
value:
|
|
service_name: designate_worker
|
|
monitoring_subscription: {get_param: MonitoringSubscriptionDesignateWorker}
|
|
logging_source: {get_param: DesignateWorkerLoggingSource}
|
|
logging_groups:
|
|
- designate
|
|
config_settings:
|
|
map_merge:
|
|
- get_attr: [DesignateBase, role_data, config_settings]
|
|
- designate::worker::worker_notify: true
|
|
dns::vardir: /var/named-persistent
|
|
dns::recursion: 'no'
|
|
dns::additional_options:
|
|
listen-on:
|
|
str_replace:
|
|
template:
|
|
"{ 127.0.0.1; %{hiera('$NETWORK')}; }"
|
|
params:
|
|
$NETWORK: {get_param: [ServiceNetMap, BINDNetwork]}
|
|
tripleo.designate_worker.firewall_rules:
|
|
'140 designate_worker udp':
|
|
proto: 'udp'
|
|
dport:
|
|
- 53
|
|
- 953
|
|
'141 designate_worker tcp':
|
|
proto: 'tcp'
|
|
dport:
|
|
- 53
|
|
- 953
|
|
-
|
|
if:
|
|
- designate_workers_zero
|
|
- {}
|
|
- designate::worker::workers: {get_param: DesignateWorkers}
|
|
step_config: |
|
|
include tripleo::profile::base::designate::worker
|