From 22019e46e2553e047fd7706c82d29d3cfb978e39 Mon Sep 17 00:00:00 2001 From: Takashi Kajinami Date: Sun, 20 Feb 2022 17:41:59 +0900 Subject: [PATCH] Fix setup of bind9 backend Designate no longer uses the parameters in the [backend:bind9] section, since ppols.yaml was introduced. This change ensures the parameters in this wrong section are purged. Also, this change introduces support for setting up backend using pools.yaml according to the current installation guide. Closes-Bug: #1961516 Change-Id: I28a91ab99325970db1e96aa904f35e8f9a5e109c --- manifests/backend/bind9.pp | 114 ++++++++++++++---- .../notes/bug-1961516-0634fabec06a4e94.yaml | 17 +++ spec/classes/designate_backend_bind9_spec.rb | 61 +++++----- templates/bind9-pools.yaml.erb | 36 ++++++ 4 files changed, 172 insertions(+), 56 deletions(-) create mode 100644 releasenotes/notes/bug-1961516-0634fabec06a4e94.yaml create mode 100644 templates/bind9-pools.yaml.erb diff --git a/manifests/backend/bind9.pp b/manifests/backend/bind9.pp index f5d0a2ba..5a95f73a 100644 --- a/manifests/backend/bind9.pp +++ b/manifests/backend/bind9.pp @@ -5,37 +5,76 @@ # == Parameters # # [*rndc_config_file*] -# (optional) Location of the rndc configuration file. -# Defaults to '/etc/rndc.conf' +# (Optional) Location of the rndc configuration file. +# Defaults to '/etc/rndc.conf' # # [*rndc_key_file*] -# (optional) Location of the rndc key file. +# (Optional) Location of the rndc key file. # Defaults to '/etc/rndc.key' # -# [*rndc_host*] -# (optional) Host running DNS service. -# Defaults to '127.0.0.1' -# # [*rndc_port*] -# (optional) Port to use for dns service on rndc_host. -# Defaults to '953' +# (Optional) RNDC Port. +# Defaults to 953. # # [*rndc_controls*] -# (optional) Hash defining controls configuration for rndc. +# (Optional) Hash defining controls configuration for rndc. # Defaults to undef, which uses the puppet-dns default # +# [*ns_records*] +# (Optional) List of the NS records for zones hosted within this pool. This +# parameter takes hash value of : mapping. +# Defaults to {1 => 'ns1.example.org.'} +# +# [*nameservers*] +# (Optional) List out the nameservers for this pool. +# Defaults to ['127.0.0,1']. +# +# [*bind9_hosts*] +# (Optional) Host running DNS service. +# Defaults to ['127.0.0,1']. +# +# [*dns_port*] +# (Optional) TCP port to connect to DNS service. +# Defaults to 53. +# +# [*mdns_hosts*] +# (Optional) Array of hosts where designate-mdns service is running. +# Defaults to ['127.0.0.1']. +# +# [*mdns_port*] +# (Optional) TCP Port to connect to designate-mdns service. +# Defaults to 5354. +# # [*configure_bind*] -# (optional) Enables running named configuration for hosts where designate and -# designate bind services are collocated. +# (Optional) Enables running bind9/named configuration for hosts where +# designate and designate bind services are collocated. # Defaults to true # +# [*manage_pool*] +# (Optional) Manage pools.yaml and update pools by designate-manage command +# Defaults to false +# +# DEPRECATED PARAMETERS +# +# [*rndc_host*] +# (Optional) RNDC Host +# Defaults to undef +# class designate::backend::bind9 ( - $rndc_host = '127.0.0.1', - $rndc_port = '953', - $rndc_config_file = '/etc/rndc.conf', - $rndc_key_file = '/etc/rndc.key', - $rndc_controls = undef, - $configure_bind = true, + $rndc_config_file = '/etc/rndc.conf', + $rndc_key_file = '/etc/rndc.key', + $rndc_controls = undef, + $rndc_port = 953, + $ns_records = {1 => 'ns1.example.org.'}, + $nameservers = ['127.0.0.1'], + $bind9_hosts = ['127.0.0.1'], + $dns_port = 5322, + $mdns_hosts = ['127.0.0.1'], + $mdns_port = 5354, + $configure_bind = true, + $manage_pool = false, + # DEPRECATED PARAMETERS + $rndc_host = undef, ) { include designate::deps @@ -56,7 +95,7 @@ class designate::backend::bind9 ( # Recommended by Designate docs as a mitigation for potential cache # poisoning attacks: - # https://docs.openstack.org/designate/queens/admin/production-guidelines.html#bind9-mitigation + # https://docs.openstack.org/designate/latest/admin/production-guidelines.html#bind9-mitigation concat::fragment { 'dns minimal-responses': target => $::dns::optionspath, content => 'minimal-responses yes;', @@ -75,11 +114,38 @@ class designate::backend::bind9 ( }) } - designate_config { - 'backend:bind9/rndc_host' : value => $rndc_host; - 'backend:bind9/rndc_port' : value => $rndc_port; - 'backend:bind9/rndc_config_file' : value => $rndc_config_file; - 'backend:bind9/rndc_key_file' : value => $rndc_key_file; + # TODO(tkajinam): Remove this after Yoga release. + if $rndc_host != undef { + warning('The rndc_host parameter is deprecated and has no effect.') } + # TODO(tkajinam): Remove this after Yoga release. + designate_config { + 'backend:bind9/rndc_host' : ensure => absent; + 'backend:bind9/rndc_port' : ensure => absent; + 'backend:bind9/rndc_config_file' : ensure => absent; + 'backend:bind9/rndc_key_file' : ensure => absent; + } + + if $manage_pool { + file { '/etc/designate/pools.yaml': + ensure => present, + path => '/etc/designate/pools.yaml', + owner => $designate::params::user, + group => $designate::params::group, + mode => '0640', + content => template('designate/bind9-pools.yaml.erb'), + require => Anchor['designate::config::begin'], + before => Anchor['designate::config::end'], + } + + exec { 'designate-manage pool update': + command => 'designate-manage pool update', + path => '/usr/bin', + user => $designate::params::user, + refreshonly => true, + require => Anchor['designate::service::end'], + subscribe => File['/etc/designate/pools.yaml'], + } + } } diff --git a/releasenotes/notes/bug-1961516-0634fabec06a4e94.yaml b/releasenotes/notes/bug-1961516-0634fabec06a4e94.yaml new file mode 100644 index 00000000..4d6d43ce --- /dev/null +++ b/releasenotes/notes/bug-1961516-0634fabec06a4e94.yaml @@ -0,0 +1,17 @@ +--- +features: + - | + Now the ``designate::backend::bind9`` class supports setting up bind9 + backend using ``/etc/designate/pools.yaml`` properly. This feature can be + enabled by the new ``manage_pool`` parameter. + +deprecations: + - | + The ``designate::backend::bind9::rndc_host`` parameter has been deprecated + and has no effect now. + +fixes: + - | + The ``designate::backend::bind9`` class no longer configures parameters + in the ``[backend:bind9]`` section, as these parameters are no longer + effective. diff --git a/spec/classes/designate_backend_bind9_spec.rb b/spec/classes/designate_backend_bind9_spec.rb index c3d95db1..95b4512d 100644 --- a/spec/classes/designate_backend_bind9_spec.rb +++ b/spec/classes/designate_backend_bind9_spec.rb @@ -7,53 +7,50 @@ describe 'designate::backend::bind9' do shared_examples 'designate-backend-bind9' do context 'with default params' do - it 'configures designate backend bind9 with default parameters' do - is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value('127.0.0.1') - is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value('953') - is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value('/etc/rndc.conf') - is_expected.to contain_designate_config('backend:bind9/rndc_key_file').with_value('/etc/rndc.key') + # TODO(tkajinam): remove this once we update the default value + let :params do + { :manage_pool => true } + end + it 'configures named and pool' do is_expected.to contain_concat_fragment('dns allow-new-zones').with( :target => platform_params[:dns_optionspath], - :content => 'allow-new-zones yes;') + :content => 'allow-new-zones yes;' + ) + is_expected.to contain_file('/etc/designate/pools.yaml').with( + :ensure => 'present', + :path => '/etc/designate/pools.yaml', + :owner => 'designate', + :group => 'designate', + :mode => '0640', + ) + is_expected.to contain_exec('designate-manage pool update').with( + :command => 'designate-manage pool update', + :path => '/usr/bin', + :user => 'designate', + :refreshonly => true, + ) end end - context 'with named configuration disabled ' do + context 'with named configuration disabled' do let :params do { :configure_bind => false } end - it 'configures designate backend bind9 with default parameters' do - is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value('127.0.0.1') - is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value('953') - is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value('/etc/rndc.conf') - is_expected.to contain_designate_config('backend:bind9/rndc_key_file').with_value('/etc/rndc.key') + it 'does not configure named' do is_expected.not_to contain_concat_fragment('dns allow-new-zones') end end - context 'when overriding rndc_config_file' do + context 'with pool management disabled' do let :params do - { :rndc_config_file => '/srv/designate/rndc.conf' } + { :manage_pool => false } end - - it 'configures designate bind9 backend with custom rndc_config_file' do - is_expected.to contain_designate_config('backend:bind9/rndc_config_file').with_value(params[:rndc_config_file]) + it 'does not configure pool' do + is_expected.to_not contain_file('/etc/designate/pools.yaml') + is_expected.to_not contain_exec('designate-manage pool update') end end - context 'when overriding rndc_host and rndc_port' do - let :params do - { - :rndc_host => '10.0.0.42', - :rndc_port => '1337' - } - end - - it 'configures designate bind9 backend with custom rndc_port and rndc_host' do - is_expected.to contain_designate_config('backend:bind9/rndc_port').with_value(params[:rndc_port]) - is_expected.to contain_designate_config('backend:bind9/rndc_host').with_value(params[:rndc_host]) - end - end end on_supported_os({ @@ -70,11 +67,11 @@ describe 'designate::backend::bind9' do case facts[:osfamily] when 'Debian' { - :dns_optionspath => '/etc/bind/named.conf.options' + :dns_optionspath => '/etc/bind/named.conf.options' } when 'RedHat' { - :dns_optionspath => '/etc/named/options.conf' + :dns_optionspath => '/etc/named/options.conf' } end end diff --git a/templates/bind9-pools.yaml.erb b/templates/bind9-pools.yaml.erb new file mode 100644 index 00000000..585fd0ad --- /dev/null +++ b/templates/bind9-pools.yaml.erb @@ -0,0 +1,36 @@ +--- +- name: default + description: Default pool + attributes: {} + + ns_records: +<% @ns_records.sort.each do |priority, hostname| -%> + - hostname: <%= hostname %> + priority: <%= priority.to_s %> +<% end -%> + + nameservers: +<% @nameservers.each do |nameserver| -%> + - host: <%= nameserver %> + port: <%= @dns_port.to_s %> +<% end -%> + + targets: +<% @bind9_hosts.each do |bind9_host| -%> + - type: bind9 + description: BIND9 Server <%= bind9_host %> + + masters: +<% @mdns_hosts.each do |mdns_host| -%> + - host: <%= mdns_host %> + port: <%= @mdns_port.to_s %> +<% end -%> + + options: + host: <%= bind9_host %> + port: <%= @dns_port.to_s %> + rndc_host: <%= bind9_host %> + rndc_port: <%= @rndc_port %> + rndc_config_file: <%= @rndc_config_file %> + rndc_key_file: <%= @rndc_key_file %> +<% end -%>