Chapter 8. Using Ansible to manage DNS records in IdM

PDF

This chapter describes how to manage DNS records in Identity Management (IdM) using an Ansible playbook. As an IdM administrator, you can add, modify, and delete DNS records in IdM. The chapter contains the following sections:

8.1. DNS records in IdM

Identity Management (IdM) supports many different DNS record types. The following four are used most frequently:

A

This is a basic map for a host name and an IPv4 address. The record name of an A record is a host name, such as www. The IP Address value of an A record is an IPv4 address, such as 192.0.2.1.

For more information about A records, see RFC 1035.

AAAA

This is a basic map for a host name and an IPv6 address. The record name of an AAAA record is a host name, such as www. The IP Address value is an IPv6 address, such as 2001:DB8::1111.

For more information about AAAA records, see RFC 3596.

SRV

Service (SRV) resource records map service names to the DNS name of the server that is providing that particular service. For example, this record type can map a service like an LDAP directory to the server which manages it.

The record name of an SRV record has the format _service._protocol, such as _ldap._tcp. The configuration options for SRV records include priority, weight, port number, and host name for the target service.

For more information about SRV records, see RFC 2782.

PTR

A pointer record (PTR) adds a reverse DNS record, which maps an IP address to a domain name.

Note

All reverse DNS lookups for IPv4 addresses use reverse entries that are defined in the in-addr.arpa. domain. The reverse address, in human-readable form, is the exact reverse of the regular IP address, with the in-addr.arpa. domain appended to it. For example, for the network address 192.0.2.0/24, the reverse zone is 2.0.192.in-addr.arpa.

The record name of a PTR must be in the standard format specified in RFC 1035, extended in RFC 2317, and RFC 3596. The host name value must be a canonical host name of the host for which you want to create the record.

Note

Reverse zones can also be configured for IPv6 addresses, with zones in the .ip6.arpa. domain. For more information about IPv6 reverse zones, see RFC 3596.

When adding DNS resource records, note that many of the records require different data. For example, a CNAME record requires a host name, while an A record requires an IP address. In the IdM Web UI, the fields in the form for adding a new record are updated automatically to reflect what data is required for the currently selected type of record.

8.2. Common ipa dnsrecord-* options

You can use the following options when adding, modifying and deleting the most common DNS resource record types in Identity Management (IdM):

A (IPv4)
AAAA (IPv6)
SRV
PTR

In Bash, you can define multiple entries by listing the values in a comma-separated list inside curly braces, such as --⁠option={val1,val2,val3}.

Table 8.1. General Record Options
Option	Description
`--ttl`=number	Sets the time to live for the record.
`--structured`	Parses the raw DNS records and returns them in a structured format.

Table 8.2. "A" record options
Option	Description	Examples
`--a-rec`=ARECORD	Passes a single A record or a list of A records.	`ipa dnsrecord-add idm.example.com host1 --a-rec=192.168.122.123`
`--a-rec`=ARECORD	Can create a wildcard A record with a given IP address.	`ipa dnsrecord-add idm.example.com "*" --a-rec=192.168.122.123` ^[a]
`--a-ip-address`=string	Gives the IP address for the record. When creating a record, the option to specify the `A` record value is `--a-rec`. However, when modifying an `A` record, the `--a-rec` option is used to specify the current value for the `A` record. The new value is set with the `--a-ip-address` option.	`ipa dnsrecord-mod idm.example.com --a-rec 192.168.122.123 --a-ip-address 192.168.122.124`
^[a] The example creates a wildcard `A` record with the IP address of 192.0.2.123.

Table 8.3. "AAAA" record options
Option	Description	Example
`--aaaa-rec`=AAAARECORD	Passes a single AAAA (IPv6) record or a list of AAAA records.	`ipa dnsrecord-add idm.example.com www --aaaa-rec 2001:db8::1231:5675`
`--aaaa-ip-address`=string	Gives the IPv6 address for the record. When creating a record, the option to specify the `A` record value is `--aaaa-rec`. However, when modifying an `A` record, the `--aaaa-rec` option is used to specify the current value for the `A` record. The new value is set with the `--a-ip-address` option.	`ipa dnsrecord-mod idm.example.com --aaaa-rec 2001:db8::1231:5675 --aaaa-ip-address 2001:db8::1231:5676`

Table 8.4. "PTR" record options
Option	Description	Example
`--ptr-rec`=PTRRECORD	Passes a single PTR record or a list of PTR records. When adding the reverse DNS record, the zone name used with the `ipa dnsrecord-add` command is reversed, compared to the usage for adding other DNS records. Typically, the host IP address is the last octet of the IP address in a given network. The first example on the right adds a PTR record for server4.idm.example.com with IPv4 address 192.168.122.4. The second example adds a reverse DNS entry to the 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. IPv6 reverse zone for the host server2.example.com with the IP address 2001:DB8::1111.	`ipa dnsrecord-add 122.168.192.in-addr.arpa 4 --ptr-rec server4.idm.example.com.`
`--ptr-rec`=PTRRECORD		`$ ipa dnsrecord-add 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. 1.1.1.0.0.0.0.0.0.0.0.0.0.0.0 --ptr-rec server2.idm.example.com.`
`--ptr-hostname`=string	Gives the host name for the record.

Table 8.5. "SRV" Record Options
Option	Description	Example
`--srv-rec`=SRVRECORD	Passes a single SRV record or a list of SRV records. In the examples on the right, _ldap._tcp defines the service type and the connection protocol for the SRV record. The `--srv-rec` option defines the priority, weight, port, and target values. The weight values of 51 and 49 in the examples add up to 100 and represent the probability, in percentages, that a particular record is used.	`# ipa dnsrecord-add idm.example.com _ldap._tcp --srv-rec="0 51 389 server1.idm.example.com."`
`--srv-rec`=SRVRECORD		`# ipa dnsrecord-add server.idm.example.com _ldap._tcp --srv-rec="1 49 389 server2.idm.example.com."`
`--srv-priority`=number	Sets the priority of the record. There can be multiple SRV records for a service type. The priority (0 - 65535) sets the rank of the record; the lower the number, the higher the priority. A service has to use the record with the highest priority first.	`# ipa dnsrecord-mod server.idm.example.com _ldap._tcp --srv-rec="1 49 389 server2.idm.example.com." --srv-priority=0`
`--srv-weight`=number	Sets the weight of the record. This helps determine the order of SRV records with the same priority. The set weights should add up to 100, representing the probability (in percentages) that a particular record is used.	`# ipa dnsrecord-mod server.idm.example.com _ldap._tcp --srv-rec="0 49 389 server2.idm.example.com." --srv-weight=60`
`--srv-port`=number	Gives the port for the service on the target host.	`# ipa dnsrecord-mod server.idm.example.com _ldap._tcp --srv-rec="0 60 389 server2.idm.example.com." --srv-port=636`
`--srv-target`=string	Gives the domain name of the target host. This can be a single period (.) if the service is not available in the domain.

Additional resources

Run ipa dnsrecord-add --help.

8.3. Ensuring the presence of A and AAAA DNS records in IdM using Ansible

Follow this procedure to use an Ansible playbook to ensure that A and AAAA records for a particular IdM host are present. In the example used in the procedure below, an IdM administrator ensures the presence of A and AAAA records for host1 in the idm.example.com DNS zone.

Prerequisites

You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
- You have installed the ansible-freeipa package on the Ansible controller.
- The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
- The example assumes that the secret.yml Ansible vault stores your ipaadmin_password.
The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
You know the IdM administrator password.
The idm.example.com zone exists and is managed by IdM DNS. For more information about adding a primary DNS zone in IdM DNS, see Using Ansible playbooks to manage IdM DNS zones.

Procedure

Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:
```
$ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
```
Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:
```
[ipaserver]
server.idm.example.com
```

Make a copy of the ensure-A-and-AAAA-records-are-present.yml Ansible playbook file. For example:

$ cp ensure-A-and-AAAA-records-are-present.yml ensure-A-and-AAAA-records-are-present-copy.yml

Open the ensure-A-and-AAAA-records-are-present-copy.yml file for editing.

Adapt the file by setting the following variables in the ipadnsrecord task section:

Set the ipaadmin_password variable to your IdM administrator password.
Set the zone_name variable to idm.example.com.
In the records variable, set the name variable to host1, and the a_ip_address variable to 192.168.122.123.
In the records variable, set the name variable to host1, and the aaaa_ip_address variable to ::1.
This is the modified Ansible playbook file for the current example:

---
- name: Ensure A and AAAA records are present
  hosts: ipaserver
  become: true
  gather_facts: false

  tasks:
  # Ensure A and AAAA records are present
  - name: Ensure that 'host1' has A and AAAA records.
    ipadnsrecord:
      ipaadmin_password: "{{ ipaadmin_password }}"
      zone_name: idm.example.com
      records:
      - name: host1
        a_ip_address: 192.168.122.123
      - name: host1
        aaaa_ip_address: ::1

Save the file.

Run the playbook:

$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-A-and-AAAA-records-are-present-copy.yml

Additional resources

See DNS records in IdM.
See the README-dnsrecord.md file in the /usr/share/doc/ansible-freeipa/ directory.
See sample Ansible playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory.

8.4. Ensuring the presence of A and PTR DNS records in IdM using Ansible

Follow this procedure to use an Ansible playbook to ensure that an A record for a particular IdM host is present, with a corresponding PTR record. In the example used in the procedure below, an IdM administrator ensures the presence of A and PTR records for host1 with an IP address of 192.168.122.45 in the idm.example.com zone.

Prerequisites

You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
- You have installed the ansible-freeipa package on the Ansible controller.
- The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
- The example assumes that the secret.yml Ansible vault stores your ipaadmin_password.
The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
You know the IdM administrator password.
The idm.example.com DNS zone exists and is managed by IdM DNS. For more information about adding a primary DNS zone in IdM DNS, see Using Ansible playbooks to manage IdM DNS zones.

Procedure

Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:
```
$ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
```
Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:
```
[ipaserver]
server.idm.example.com
```

Make a copy of the ensure-dnsrecord-with-reverse-is-present.yml Ansible playbook file. For example:

$ cp ensure-dnsrecord-with-reverse-is-present.yml ensure-dnsrecord-with-reverse-is-present-copy.yml

Open the ensure-dnsrecord-with-reverse-is-present-copy.yml file for editing.

Adapt the file by setting the following variables in the ipadnsrecord task section:

Set the ipaadmin_password variable to your IdM administrator password.
Set the name variable to host1.
Set the zone_name variable to idm.example.com.
Set the ip_address variable to 192.168.122.45.
Set the create_reverse variable to true.
This is the modified Ansible playbook file for the current example:

---
- name: Ensure DNS Record is present.
  hosts: ipaserver
  become: true
  gather_facts: false

  tasks:
  # Ensure that dns record is present
  - ipadnsrecord:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: host1
      zone_name: idm.example.com
      ip_address: 192.168.122.45
      create_reverse: true
      state: present

Save the file.

Run the playbook:

$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-dnsrecord-with-reverse-is-present-copy.yml

Additional resources

See DNS records in IdM.
See the README-dnsrecord.md file in the /usr/share/doc/ansible-freeipa/ directory.
See sample Ansible playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory.

8.5. Ensuring the presence of multiple DNS records in IdM using Ansible

Follow this procedure to use an Ansible playbook to ensure that multiple values are associated with a particular IdM DNS record. In the example used in the procedure below, an IdM administrator ensures the presence of multiple A records for host1 in the idm.example.com DNS zone.

Prerequisites

You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
- You have installed the ansible-freeipa package on the Ansible controller.
- The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
- The example assumes that the secret.yml Ansible vault stores your ipaadmin_password.
The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
You know the IdM administrator password.
The idm.example.com zone exists and is managed by IdM DNS. For more information about adding a primary DNS zone in IdM DNS, see Using Ansible playbooks to manage IdM DNS zones.

Procedure

Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:
```
$ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
```
Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:
```
[ipaserver]
server.idm.example.com
```
Make a copy of the ensure-presence-multiple-records.yml Ansible playbook file. For example:
```
$ cp ensure-presence-multiple-records.yml ensure-presence-multiple-records-copy.yml
```
Open the ensure-presence-multiple-records-copy.yml file for editing.
Adapt the file by setting the following variables in the ipadnsrecord task section:
- Set the ipaadmin_password variable to your IdM administrator password.
- In the records section, set the name variable to host1.
- In the records section, set the zone_name variable to idm.example.com.
- In the records section, set the a_rec variable to 192.168.122.112 and to 192.168.122.122.
- Define a second record in the records section:
  - Set the name variable to host1.
  - Set the zone_name variable to idm.example.com.
  - Set the aaaa_rec variable to ::1.
  This is the modified Ansible playbook file for the current example:
```
---
- name: Test multiple DNS Records are present.
  hosts: ipaserver
  become: true
  gather_facts: false

  tasks:
  # Ensure that multiple dns records are present
  - ipadnsrecord:
      ipaadmin_password: "{{ ipaadmin_password }}"
      records:
        - name: host1
          zone_name: idm.example.com
          a_rec: 192.168.122.112
          a_rec: 192.168.122.122
        - name: host1
          zone_name: idm.example.com
          aaaa_rec: ::1
```
Save the file.

Run the playbook:

$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-records-copy.yml

Additional resources

See DNS records in IdM.
See the README-dnsrecord.md file in the /usr/share/doc/ansible-freeipa/ directory.
See sample Ansible playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory.

8.6. Ensuring the presence of multiple CNAME records in IdM using Ansible

A Canonical Name record (CNAME record) is a type of resource record in the Domain Name System (DNS) that maps one domain name, an alias, to another name, the canonical name.

You may find CNAME records useful when running multiple services from a single IP address: for example, an FTP service and a web service, each running on a different port.

Follow this procedure to use an Ansible playbook to ensure that multiple CNAME records are present in IdM DNS. In the example used in the procedure below, host03 is both an HTTP server and an FTP server. The IdM administrator ensures the presence of the www and ftp CNAME records for the host03 A record in the idm.example.com zone.

Prerequisites

You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
- You have installed the ansible-freeipa package on the Ansible controller.
- The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
- The example assumes that the secret.yml Ansible vault stores your ipaadmin_password.
The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
You know the IdM administrator password.
The idm.example.com zone exists and is managed by IdM DNS. For more information about adding a primary DNS zone in IdM DNS, see Using Ansible playbooks to manage IdM DNS zones.
The host03 A record exists in the idm.example.com zone.

Procedure

Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:
```
$ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
```
Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:
```
[ipaserver]
server.idm.example.com
```
Make a copy of the ensure-CNAME-record-is-present.yml Ansible playbook file. For example:
```
$ cp ensure-CNAME-record-is-present.yml ensure-CNAME-record-is-present-copy.yml
```
Open the ensure-CNAME-record-is-present-copy.yml file for editing.
Adapt the file by setting the following variables in the ipadnsrecord task section:
- (Optional) Adapt the description provided by the name of the play.
- Set the ipaadmin_password variable to your IdM administrator password.
- Set the zone_name variable to idm.example.com.
- In the records variable section, set the following variables and values:
  - Set the name variable to www.
  - Set the cname_hostname variable to host03.
  - Set the name variable to ftp.
  - Set the cname_hostname variable to host03.
  This is the modified Ansible playbook file for the current example:
```
---
- name: Ensure that 'www.idm.example.com' and 'ftp.idm.example.com' CNAME records point to 'host03.idm.example.com'.
  hosts: ipaserver
  become: true
  gather_facts: false

  tasks:
  - ipadnsrecord:
      ipaadmin_password: "{{ ipaadmin_password }}"
      zone_name: idm.example.com
      records:
      - name: www
        cname_hostname: host03
      - name: ftp
        cname_hostname: host03
```
Save the file.

Run the playbook:

$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-CNAME-record-is-present.yml

Additional resources

See the README-dnsrecord.md file in the /usr/share/doc/ansible-freeipa/ directory.
See sample Ansible playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory.

8.7. Ensuring the presence of an SRV record in IdM using Ansible

A DNS service (SRV) record defines the hostname, port number, transport protocol, priority and weight of a service available in a domain. In Identity Management (IdM), you can use SRV records to locate IdM servers and replicas.

Follow this procedure to use an Ansible playbook to ensure that an SRV record is present in IdM DNS. In the example used in the procedure below, an IdM administrator ensures the presence of the _kerberos._udp.idm.example.com SRV record with the value of 10 50 88 idm.example.com. This sets the following values:

It sets the priority of the service to 10.
It sets the weight of the service to 50.
It sets the port to be used by the service to 88.

Prerequisites

You have configured your Ansible control node to meet the following requirements:
- You are using Ansible version 2.14 or later.
- You have installed the ansible-freeipa package on the Ansible controller.
- The example assumes that in the ~/MyPlaybooks/ directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server.
- The example assumes that the secret.yml Ansible vault stores your ipaadmin_password.
The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica.
You know the IdM administrator password.
The idm.example.com zone exists and is managed by IdM DNS. For more information about adding a primary DNS zone in IdM DNS, see Using Ansible playbooks to manage IdM DNS zones.

Procedure

Navigate to the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory:
```
$ cd /usr/share/doc/ansible-freeipa/playbooks/dnsrecord
```
Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:
```
[ipaserver]
server.idm.example.com
```
Make a copy of the ensure-SRV-record-is-present.yml Ansible playbook file. For example:
```
$ cp ensure-SRV-record-is-present.yml ensure-SRV-record-is-present-copy.yml
```
Open the ensure-SRV-record-is-present-copy.yml file for editing.

Adapt the file by setting the following variables in the ipadnsrecord task section:

Set the ipaadmin_password variable to your IdM administrator password.
Set the name variable to _kerberos._udp.idm.example.com.
Set the srv_rec variable to '10 50 88 idm.example.com'.
Set the zone_name variable to idm.example.com.
This the modified Ansible playbook file for the current example:

---
- name: Test multiple DNS Records are present.
  hosts: ipaserver
  become: true
  gather_facts: false

  tasks:
  # Ensure a SRV record is present
  - ipadnsrecord:
      ipaadmin_password: "{{ ipaadmin_password }}"
      name: _kerberos._udp.idm.example.com
      srv_rec: ’10 50 88 idm.example.com’
      zone_name: idm.example.com
      state: present

Save the file.

Run the playbook:

$ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-SRV-record-is-present.yml

Additional resources

See DNS records in IdM.
See the README-dnsrecord.md file in the /usr/share/doc/ansible-freeipa/ directory.
See sample Ansible playbooks in the /usr/share/doc/ansible-freeipa/playbooks/dnsrecord directory.

Chapter 8. Using Ansible to manage DNS records in IdM

8.1. DNS records in IdM

8.2. Common ipa dnsrecord-* options

8.3. Ensuring the presence of A and AAAA DNS records in IdM using Ansible

8.4. Ensuring the presence of A and PTR DNS records in IdM using Ansible

8.5. Ensuring the presence of multiple DNS records in IdM using Ansible

8.6. Ensuring the presence of multiple CNAME records in IdM using Ansible

8.7. Ensuring the presence of an SRV record in IdM using Ansible

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Red Hat legal and privacy links

Red Hat legal and privacy links