Working with DNS in Identity Management

1. The DNS installation script creates an /etc/NetworkManager/conf.d/zzz-ipa.conf NetworkManager configuration file to control the search order and DNS server list:

   # auto-generated by IPA installer
   [main]
   dns=default
   
   [global-dns]
   searches=$DOMAIN
   
   [global-dns-domain-*]
   servers=127.0.0.1

   Copy to Clipboard Toggle word wrap
2. The NetworkManager service is reloaded, which always creates the /etc/resolv.conf file with the settings from the last file in the /etc/NetworkManager/conf.d/ directory. This is in this case the zzz-ipa.conf file.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the freeipa.ansible_freeipa.ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       freeipa.ansible_freeipa.ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the freeipa.ansible_freeipa.ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       freeipa.ansible_freeipa.ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Copy to Clipboard Toggle word wrap
   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the set-configuration.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/set-configuration.yml set-forward-policy-to-first.yml

   Copy to Clipboard Toggle word wrap
3. Open the set-forward-policy-to-first.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the forward_policy variable to first.

     Delete all the other lines of the original playbook that are irrelevant. This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to set global forwarding policy to first
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Set global forwarding policy to first.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: first

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the disable-global-forwarders.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/disable-global-forwarders.yml disable-global-forwarders-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the disable-global-forwarders-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the forward_policy variable to none.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disable global forwarders.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: none

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory disable-global-forwarders-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the disallow-reverse-sync.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/disallow-reverse-sync.yml disallow-reverse-sync-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the disallow-reverse-sync-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the allow_sync_ptr variable to no.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disallow reverse record synchronization
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disallow reverse record synchronization.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         allow_sync_ptr: no

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   Managing IdM DNS primary zones

   
2. Click Add at the top of the list of all zones.

3. Provide the zone name.

   Entering an new IdM primary zone

   
4. Click Add.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

2. Select the check box by the zone name and click Delete.

   Removing a primary DNS Zone

   
3. In the Remove DNS zones dialog window, confirm that you want to delete the selected zone.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.

   DNS primary zones management

   

2. In the DNS Zones section, click on the zone name in the list of all zones to open the DNS zone page.

   Editing a primary zone

   

3. Click Settings.

   The Settings tab in the primary zone edit page

   

4. Change the zone configuration as required.

   For information about the available settings, see IdM DNS zone attributes.

5. Click Save to confirm the new configuration.

   Note

   If you are changing the default time to live (TTL) of a zone, restart the named service on all IdM DNS servers to make the changes take effect. All other settings are automatically activated immediately.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click Settings.

3. Under Allow transfer, specify the name servers to which you want to transfer the zone records.

   Figure 2.1. Enabling zone transfers

   
4. Click Save at the top of the DNS zone page to confirm the new configuration.

Verification

1. SSH to one of the DNS servers to which zone transfer has been enabled:

   $ ssh 192.0.2.1

   Copy to Clipboard Toggle word wrap

2. Transfer the IdM DNS zone using a tool such as the dig utility:

   # dig @ipa-server zone_name AXFR

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Open your inventory file and ensure that the IdM server that you want to configure is listed in the [ipaserver] section. For example, to instruct Ansible to configure server.idm.example.com, enter:

   [ipaserver]
   server.idm.example.com

   Copy to Clipboard Toggle word wrap

3. Make a copy of the dnszone-present.yml Ansible playbook file. For example:

   $ cp dnszone-present.yml dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap
4. Open the dnszone-present-copy.yml file for editing.

5. Adapt the file by setting the following variables in the ipadnszone task section:

   • Set the ipaadmin_password variable to your IdM administrator password.

   • Set the zone_name variable to zone.idm.example.com.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         state: present

   Copy to Clipboard Toggle word wrap

6. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnszone.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory on the control node.

7. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Make a copy of the dnszone-all-params.yml Ansible playbook file. For example:

   $ cp dnszone-all-params.yml dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the dnszone-all-params-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnszone task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the zone_name variable to zone.idm.example.com.
   • Set the allow_sync_ptr variable to true if you want to allow the synchronization of forward and reverse records, that is the synchronization of A and AAAA records with PTR records.
   • Set the dynamic_update variable to true to enable IdM client machines to add or update their IP addresses.
   • Set the dnssec variable to true to allow inline DNSSEC signing of records in the zone.
   • Set the allow_transfer variable to the IP addresses of secondary name servers in the zone.
   • Set the allow_query variable to the IP addresses or networks that are allowed to issue queries.
   • Set the forwarders variable to the IP addresses of global forwarders.
   • Set the serial variable to the SOA record serial number.
   • Define the refresh, retry, expire, minimum, ttl, and default_ttl values for DNS records in the zone.
   • Define the NSEC3PARAM record for the zone using the nsec3param_rec variable.
   • Set the skip_overlap_check variable to true to force DNS creation even if it overlaps with an existing zone.

   • Set the skip_nameserver_check to true to force DNS zone creation even if the nameserver is not resolvable.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure dnszone present
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Ensure zone is present.
       freeipa.ansible_freeipa.ipadnszone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: zone.idm.example.com
         allow_sync_ptr: true
         dynamic_update: true
         dnssec: true
         allow_transfer:
           - 1.1.1.1
           - 2.2.2.2
         allow_query:
           - 1.1.1.1
           - 2.2.2.2
         forwarders:
           - ip_address: 8.8.8.8
           - ip_address: 8.8.4.4
             port: 52
         serial: 1234
         refresh: 3600
         retry: 900
         expire: 1209600
         minimum: 3600
         ttl: 60
         default_ttl: 90
         name_server: server.idm.example.com.
         admin_email: admin.admin@idm.example.com
         nsec3param_rec: "1 7 100 0123456789abcdef"
         skip_overlap_check: true
         skip_nameserver_check: true
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnszone.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-all-params-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone

   Copy to Clipboard Toggle word wrap

2. Make a copy of the dnszone-reverse-from-ip.yml Ansible playbook file. For example:

   $ cp dnszone-reverse-from-ip.yml dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the dnszone-reverse-from-ip-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnszone task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the name_from_ip variable to the IP of your IdM nameserver, and provide its prefix length.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Ensure dnszone present
       hosts: ipaserver
       become: true
     
       tasks:
       - name: Ensure zone for reverse DNS lookup is present.
         freeipa.ansible_freeipa.ipadnszone:
           ipaadmin_password: "{{ ipaadmin_password }}"
           name_from_ip: 192.168.1.2/24
           state: present
         register: result
       - name: Display inferred zone name.
         debug:
           msg: "Zone name: {{ result.dnszone.name }}"

     Copy to Clipboard Toggle word wrap

   The playbook creates a zone for reverse DNS lookup from the 192.168.1.2 IP address and its prefix length of 24. Next, the playbook displays the resulting zone name.

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnszone.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnszone directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file dnszone-reverse-from-ip-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the IPA Server tab.
2. Select Topology subtab.
3. Click IPA Locations in the navigation bar.
4. Click Add at the top of the locations list.
5. Fill in the location name.
6. Click the Add button to save the location.
7. Optional: Repeat the steps to add further locations.

Procedure

1. For example, to create a new location germany, enter:

   $ ipa location-add germany

   Copy to Clipboard Toggle word wrap

   ----------------------------
   Added IPA location "germany"
   ----------------------------
     Location name: germany

   Copy to Clipboard Toggle word wrap
2. Optional: Repeat the step to add further locations.

Procedure

1. Open the IPA Server tab.
2. Select the Topology subtab.
3. Click IPA Servers in the navigation.
4. Click on the IdM server name.

5. Select a DNS location, and optionally set a service weight:

   Assigning a server to a DNS location

   
6. Click Save.

7. On the command line (CLI) of the host you assigned in the previous steps the DNS location to, restart the named service:

   [root@idmserver-01 ~]# systemctl restart named

   Copy to Clipboard Toggle word wrap
8. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Optional: List all configured DNS locations:

   [root@server ~]# ipa location-find

   Copy to Clipboard Toggle word wrap

   -----------------------
   2 IPA locations matched
   -----------------------
   Location name: australia
   Location name: germany
   -----------------------------
   Number of entries returned: 2
   -----------------------------

   Copy to Clipboard Toggle word wrap

2. Assign the server to the DNS location. For example, to assign the location germany to the server idmserver-01.idm.example.com, run:

   # ipa server-mod idmserver-01.idm.example.com --location=germany

   Copy to Clipboard Toggle word wrap

   [...]
   --------------------------------------------------
   Modified IPA server "idmserver-01.idm.example.com"
   --------------------------------------------------
   Servername: idmserver-01.idm.example.com
   Min domain level: 0
   Max domain level: 1
   Location: germany
   Enabled server roles: DNS server, NTP server

   Copy to Clipboard Toggle word wrap

3. Restart the named service on the host you assigned in the previous steps the DNS location to:

   # systemctl restart named

   Copy to Clipboard Toggle word wrap
4. Optional: Repeat the steps to assign DNS locations to further IdM servers.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the location-present.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location/ directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location/location-present.yml location-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the location-present-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to the name of the location.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location present example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is present
       freeipa.ansible_freeipa.ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-location.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location directory on the control node.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the location-absent.yml file located in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location/ directory:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location/location-absent.yml location-absent-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the location-absent-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipalocation task section:

   • Adapt the name of the task to correspond to your use case.
   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to the name of the DNS location.
   • Make sure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: location absent example
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure that the "germany" location is absent
       freeipa.ansible_freeipa.ipalocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: germany
         state: absent

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-location.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/location directory on the control node.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory location-absent-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, select Network Services → DNS Global Configuration → DNS.

   

2. In the DNS Global Configuration section, click Add.

   

3. Specify the IP address of the DNS server that will receive forwarded DNS queries.

   

4. Select the Forward policy.

   
5. Click Save at the top of the window.

Verification

1. Select Network Services → DNS Global Configuration → DNS.

   

2. Verify that the global forwarder, with the forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

2. In the DNS Forward Zones section, click Add.

   

3. In the Add DNS forward zone window, specify the forward zone name.

   

4. Click the Add button and specify the IP address of a DNS server to receive the forwarding request. You can specify multiple forwarders per forward zone.

   

5. Select the Forward policy.

   
6. Click Add at the bottom of the window to add the new forward zone.

Verification

1. In the IdM Web UI, select Network Services → DNS Forward Zones → DNS.

   

2. Verify that the forward zone you created, with the forwarders and forward policy you specified, is present and enabled in the IdM Web UI.

   

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Make a copy of the set-configuration.yml Ansible playbook file. For example:

   $ cp set-configuration.yml establish-global-forwarder.yml

   Copy to Clipboard Toggle word wrap
3. Open the establish-global-forwarder.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to establish a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800.

   3. In the forwarders section of the freeipa.ansible_freeipa.ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.

   4. Change the forward_policy to first.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to establish a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Create a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800
       freeipa.ansible_freeipa.ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         forward_policy: first
         allow_sync_ptr: true

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file establish-global-forwarder.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Verify the contents of the disable-global-forwarders.yml Ansible playbook file which is already configured to disable all DNS global forwarders. For example:

   $ cat disable-global-forwarders.yml

   Copy to Clipboard Toggle word wrap

   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Disable global forwarders.
       freeipa.ansible_freeipa.ipadnsconfig:
         forward_policy: none

   Copy to Clipboard Toggle word wrap

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsconfig.md file on the control node.

3. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-forwardzone.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-presence-forwardzone.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of a dnsforwardzone for example.com to 8.8.8.8.
   3. In the tasks section, change the freeipa.ansible_freeipa.ipadnsconfig heading to freeipa.ansible_freeipa.ipadnsforwardzone.

   4. In the freeipa.ansible_freeipa.ipadnsforwardzone section:

      1. Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS server to receive forwarded requests by specifying it after a dash:

            - 8.8.8.8

            Copy to Clipboard Toggle word wrap
      4. Add the forwardpolicy variable and set it to first.
      5. Add the skip_overlap_check variable and set it to true.
      6. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a dnsforwardzone for example.com to 8.8.8.8
     freeipa.ansible_freeipa.ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         forwarders:
             - 8.8.8.8
         forwardpolicy: first
         skip_overlap_check: true
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsforwardzone.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-presence-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-presence-multiple-forwarders.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-presence-multiple-forwarders.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com.
   3. In the tasks section, change the freeipa.ansible_freeipa.ipadnsconfig heading to freeipa.ansible_freeipa.ipadnsforwardzone.

   4. In the freeipa.ansible_freeipa.ipadnsforwardzone section:

      1. Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
      2. Add the name variable and set it to example.com.

      3. In the forwarders section:

         1. Remove the ip_address and port lines.

         2. Add the IP address of the DNS servers you want to ensure are present, preceded by a dash:

            - 8.8.8.8
            - 4.4.4.4

            Copy to Clipboard Toggle word wrap
      4. Change the state variable to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: name: Playbook to ensure the presence of multiple forwarders in a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure presence of 8.8.8.8 and 4.4.4.4 forwarders in dnsforwardzone for example.com
     freeipa.ansible_freeipa.ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
        name: example.com
         forwarders:
             - 8.8.8.8
             - 4.4.4.4
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsforwardzone.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-multiple-forwarders.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-disabled-forwardzone.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-disabled-forwardzone.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure a dnsforwardzone is disabled in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure a dnsforwardzone for example.com is disabled.
   3. In the tasks section, change the freeipa.ansible_freeipa.ipadnsconfig heading to freeipa.ansible_freeipa.ipadnsforwardzone.

   4. In the freeipa.ansible_freeipa.ipadnsforwardzone section:

      1. Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Change the state variable to disabled.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure a dnsforwardzone is disabled in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure a dnsforwardzone for example.com is disabled
     freeipa.ansible_freeipa.ipadnsforwardzone:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: example.com
         state: disabled

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsforwardzone.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-disabled-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig

   Copy to Clipboard Toggle word wrap

2. Make a copy of the forwarders-absent.yml Ansible playbook file. For example:

   $ cp forwarders-absent.yml ensure-absence-forwardzone.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-absence-forwardzone.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a dnsforwardzone in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a dnsforwardzone for example.com.
   3. In the tasks section, change the freeipa.ansible_freeipa.ipadnsconfig heading to freeipa.ansible_freeipa.ipadnsforwardzone.

   4. In the freeipa.ansible_freeipa.ipadnsforwardzone section:

      1. Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
      2. Add the name variable and set it to example.com.
      3. Remove the entire forwarders section.
      4. Leave the state variable as absent.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a dnsforwardzone in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a dnsforwardzone for example.com
       freeipa.ansible_freeipa.ipadnsforwardzone:
          ipaadmin_password: "{{ ipaadmin_password }}"
          name: example.com
          state: absent

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about all variables used in the playbook, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsforwardzone.md file on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-forwardzone.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the DNS zone to which you want to add a DNS record.

3. In the DNS Resource Records section, click Add to add a new record.

   Adding a New DNS Resource Record

   

4. Select the type of record to create and fill out the other fields as required.

   Defining a New DNS Resource Record

   
5. Click Add to confirm the new record.

Procedure

1. To add a DNS resource record, use the ipa dnsrecord-add command. The command follows this syntax:

   $ ipa dnsrecord-add zone_name record_name --record_type_option=data

   Copy to Clipboard Toggle word wrap

   In the command above:

   • The zone_name is the name of the DNS zone to which the record is being added.
   • The record_name is an identifier for the new DNS resource record.

   For example, to add an A type DNS record of host1 to the idm.example.com zone, enter:

   $ ipa dnsrecord-add idm.example.com host1 --a-rec=192.168.122.123

   Copy to Clipboard Toggle word wrap

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example example.com..

3. In the DNS Resource Records section, click the name of the resource record.

   Selecting a DNS Resource Record

   
4. Select the check box by the name of the record type to delete.

5. Click Delete.

   Deleting a DNS Resource Record

   

   The selected record type is now deleted. The other configuration of the resource record is left intact.

Procedure

1. In the IdM Web UI, click Network Services → DNS → DNS Zones.
2. Click the zone from which you want to delete a DNS record, for example zone.example.com..
3. In the DNS Resource Records section, select the check box of the resource record to delete.

4. Click Delete.

   Deleting an Entire Resource Record

   

   The entire resource record is now deleted.

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord

   Copy to Clipboard Toggle word wrap

2. Make a copy of the ensure-A-and-AAAA-records-are-present.yml Ansible playbook file. For example:

   $ cp ensure-A-and-AAAA-records-are-present.yml ensure-A-and-AAAA-records-are-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-A-and-AAAA-records-are-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsrecord task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the zone_name variable to idm.example.com.
   • In the records variable, set the name variable to host1, and the a_ip_address variable to 192.168.122.123.

   • In the records variable, set the name variable to host1, and the aaaa_ip_address variable to ::1.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure A and AAAA records are present
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure A and AAAA records are present
     - name: Ensure that 'host1' has A and AAAA records.
       freeipa.ansible_freeipa.ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: idm.example.com
         records:
         - name: host1
           a_ip_address: 192.168.122.123
         - name: host1
           aaaa_ip_address: ::1

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsrecord.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-A-and-AAAA-records-are-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord

   Copy to Clipboard Toggle word wrap

2. Make a copy of the ensure-dnsrecord-with-reverse-is-present.yml Ansible playbook file. For example:

   $ cp ensure-dnsrecord-with-reverse-is-present.yml ensure-dnsrecord-with-reverse-is-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-dnsrecord-with-reverse-is-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsrecord task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to host1.
   • Set the zone_name variable to idm.example.com.
   • Set the ip_address variable to 192.168.122.45.

   • Set the create_reverse variable to true.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure DNS Record is present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure that dns record is present
     - freeipa.ansible_freeipa.ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: host1
         zone_name: idm.example.com
         ip_address: 192.168.122.45
         create_reverse: true
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsrecord.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-dnsrecord-with-reverse-is-present-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Make a copy of the ensure-presence-multiple-records.yml Ansible playbook file. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord/ensure-presence-multiple-records.yml ensure-presence-multiple-records-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-presence-multiple-records-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsrecord task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • In the records section, set the name variable to host1.
   • In the records section, set the zone_name variable to idm.example.com.
   • In the records section, set the a_rec variable to 192.168.122.112 and to 192.168.122.122.

   • Define a second record in the records section:

     • Set the name variable to host1.
     • Set the zone_name variable to idm.example.com.
     • Set the aaaa_rec variable to ::1.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Test multiple DNS Records are present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure that multiple dns records are present
     - freeipa.ansible_freeipa.ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         records:
           - name: host1
             zone_name: idm.example.com
             a_rec: 192.168.122.112
             a_rec: 192.168.122.122
           - name: host1
             zone_name: idm.example.com
             aaaa_rec: ::1

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsrecord.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-presence-multiple-records-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord

   Copy to Clipboard Toggle word wrap

2. Make a copy of the ensure-CNAME-record-is-present.yml Ansible playbook file. For example:

   $ cp ensure-CNAME-record-is-present.yml ensure-CNAME-record-is-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-CNAME-record-is-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsrecord task section:

   • Optional: Adapt the description provided by the name of the play.
   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the zone_name variable to idm.example.com.

   • In the records variable section, set the following variables and values:

     • Set the name variable to www.
     • Set the cname_hostname variable to host03.
     • Set the name variable to ftp.
     • Set the cname_hostname variable to host03.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Ensure that 'www.idm.example.com' and 'ftp.idm.example.com' CNAME records point to 'host03.idm.example.com'.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     - freeipa.ansible_freeipa.ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         zone_name: idm.example.com
         records:
         - name: www
           cname_hostname: host03
         - name: ftp
           cname_hostname: host03

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsrecord.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-CNAME-record-is-present.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory:

   $ cd /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord

   Copy to Clipboard Toggle word wrap

2. Make a copy of the ensure-SRV-record-is-present.yml Ansible playbook file. For example:

   $ cp ensure-SRV-record-is-present.yml ensure-SRV-record-is-present-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the ensure-SRV-record-is-present-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsrecord task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the name variable to _kerberos._udp.idm.example.com.
   • Set the srv_rec variable to '10 50 88 idm.example.com'.

   • Set the zone_name variable to idm.example.com.

     This the modified Ansible playbook file for the current example:

   ---
   - name: Test multiple DNS Records are present.
     hosts: ipaserver
     become: true
     gather_facts: false
   
     tasks:
     # Ensure a SRV record is present
     - freeipa.ansible_freeipa.ipadnsrecord:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: _kerberos._udp.idm.example.com
         srv_rec: '10 50 88 idm.example.com'
         zone_name: idm.example.com
         state: present

   Copy to Clipboard Toggle word wrap

5. Save the file.

   For details about variables and example playbooks in the FreeIPA Ansible collection, see the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/README-dnsrecord.md file and the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsrecord directory on the control node.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-SRV-record-is-present.yml

   Copy to Clipboard Toggle word wrap