Chapter 29. Using Ansible playbooks to manage IdM DNS zones

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the dnszone-present.yml Ansible playbook file. For example:

   $ cp dnszone-present.yml dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the dnszone-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the zone_name variable to zone.idm.example.com.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         state: present

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Make a copy of the dnszone-all-params.yml Ansible playbook file. For example:

   $ cp dnszone-all-params.yml dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the dnszone-all-params-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnszone task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the zone_name variable to zone.idm.example.com.
   • Set the allow_sync_ptr variable to true if you want to allow the synchronization of forward and reverse records, that is the synchronization of A and AAAA records with PTR records.
   • Set the dynamic_update variable to true to enable IdM client machines to add or update their IP addresses.
   • Set the dnssec variable to true to allow inline DNSSEC signing of records in the zone.
   • Set the allow_transfer variable to the IP addresses of secondary name servers in the zone.
   • Set the allow_query variable to the IP addresses or networks that are allowed to issue queries.
   • Set the forwarders variable to the IP addresses of global forwarders.
   • Set the serial variable to the SOA record serial number.
   • Define the refresh, retry, expire, minimum, ttl, and default_ttl values for DNS records in the zone.
   • Define the NSEC3PARAM record for the zone using the nsec3param_rec variable.
   • Set the skip_overlap_check variable to true to force DNS creation even if it overlaps with an existing zone.

   • Set the skip_nameserver_check to true to force DNS zone creation even if the nameserver is not resolvable.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       freeipa.ansible_freeipa.ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         allow_sync_ptr: true
         dynamic_update: true
         dnssec: true
         allow_transfer:
           - 1.1.1.1
           - 2.2.2.2
         allow_query:
           - 1.1.1.1
           - 2.2.2.2
         forwarders:
           - ip_address: 8.8.8.8
           - ip_address: 8.8.4.4
             port: 52
         serial: 1234
         refresh: 3600
         retry: 900
         expire: 1209600
         minimum: 3600
         ttl: 60
         default_ttl: 90
         name_server: server.idm.example.com.
         admin_email: admin.admin@idm.example.com
         nsec3param_rec: "1 7 100 0123456789abcdef"
         skip_overlap_check: true
         skip_nameserver_check: true
         state: present

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Make a copy of the dnszone-reverse-from-ip.yml Ansible playbook file. For example:

   $ cp dnszone-reverse-from-ip.yml dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the dnszone-reverse-from-ip-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnszone task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the name_from_ip variable to the IP of your IdM nameserver, and provide its prefix length.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Ensure dnszone present
       hosts: ipaserver
       become: true
     
       tasks:
       - name: Ensure zone for reverse DNS lookup is present.
         freeipa.ansible_freeipa.ipadnszone:
           ipaadmin_password: "{{ ipaadmin_password }}"
           name_from_ip: 192.168.1.2/24
           state: present
         register: result
       - name: Display inferred zone name.
         debug:
           msg: "Zone name: {{ result.dnszone.name }}"

     Copy to Clipboard Toggle word wrap

   The playbook creates a zone for reverse DNS lookup from the 192.168.1.2 IP address and its prefix length of 24. Next, the playbook displays the resulting zone name.

5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap