Chapter 1. Managing global DNS configuration in IdM using Ansible playbooks

1. The DNS installation script creates an /etc/NetworkManager/conf.d/zzz-ipa.conf NetworkManager configuration file to control the search order and DNS server list:

   # auto-generated by IPA installer
   [main]
   dns=default
   
   [global-dns]
   searches=$DOMAIN
   
   [global-dns-domain-*]
   servers=127.0.0.1

   Copy to Clipboard
2. The NetworkManager service is reloaded, which always creates the /etc/resolv.conf file with the settings from the last file in the /etc/NetworkManager/conf.d/ directory. This is in this case the zzz-ipa.conf file.

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard

2. Make a copy of the forwarders-absent.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/forwarders-absent.yml ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard
3. Open the ensure-presence-of-a-global-forwarder.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the presence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53.

   3. In the forwarders section of the freeipa.ansible_freeipa.ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 7.7.9.9.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:db8::1:0.
      3. Verify the port value is set to 53.

   4. Change the state to present.

      This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the presence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the presence of a DNS global forwarder to 7.7.9.9 and 2001:db8::1:0 on port 53
       freeipa.ansible_freeipa.ipadnsconfig:
         forwarders:
           - ip_address: 7.7.9.9
           - ip_address: 2001:db8::1:0
             port: 53
         state: present

   Copy to Clipboard
5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-presence-of-a-global-forwarder.yml

   Copy to Clipboard

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard

2. Make a copy of the forwarders-absent.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/forwarders-absent.yml ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard
3. Open the ensure-absence-of-a-global-forwarder.yml file for editing.

4. Adapt the file by setting the following variables:

   1. Change the name variable for the playbook to Playbook to ensure the absence of a global forwarder in IdM DNS.
   2. In the tasks section, change the name of the task to Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53.

   3. In the forwarders section of the freeipa.ansible_freeipa.ipadnsconfig portion:

      1. Change the first ip_address value to the IPv4 address of the global forwarder: 8.8.6.6.
      2. Change the second ip_address value to the IPv6 address of the global forwarder: 2001:4860:4860::8800.
      3. Verify the port value is set to 53.
   4. Set the action variable to member.
   5. Verify the state is set to absent.

   This the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to ensure the absence of a global forwarder in IdM DNS
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure the absence of a DNS global forwarder to 8.8.6.6 and 2001:4860:4860::8800 on port 53
       freeipa.ansible_freeipa.ipadnsconfig:
         forwarders:
           - ip_address: 8.8.6.6
           - ip_address: 2001:4860:4860::8800
             port: 53
         action: member
         state: absent

   Copy to Clipboard
   Important

   If you only use the state: absent option in your playbook without also using action: member, the playbook fails.

5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file ensure-absence-of-a-global-forwarder.yml

   Copy to Clipboard

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard

2. Make a copy of the set-configuration.yml Ansible playbook file from the relevant collections directory and rename it. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/set-configuration.yml set-forward-policy-to-first.yml

   Copy to Clipboard
3. Open the set-forward-policy-to-first.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the forward_policy variable to first.

     Delete all the other lines of the original playbook that are irrelevant. This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to set global forwarding policy to first
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Set global forwarding policy to first.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: first

   Copy to Clipboard
5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file set-forward-policy-to-first.yml

   Copy to Clipboard

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard

2. Make a copy of the disable-global-forwarders.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/disable-global-forwarders.yml disable-global-forwarders-copy.yml

   Copy to Clipboard
3. Open the disable-global-forwarders-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the forward_policy variable to none.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disable global DNS forwarders
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disable global forwarders.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         forward_policy: none

   Copy to Clipboard
5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disable-global-forwarders-copy.yml

   Copy to Clipboard

Procedure

1. Navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard

2. Make a copy of the disallow-reverse-sync.yml Ansible playbook file from the relevant collections directory. For example:

   $ cp /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/dnsconfig/disallow-reverse-sync.yml disallow-reverse-sync-copy.yml

   Copy to Clipboard
3. Open the disallow-reverse-sync-copy.yml file for editing.

4. Adapt the file by setting the following variables in the freeipa.ansible_freeipa.ipadnsconfig task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • Set the allow_sync_ptr variable to no.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to disallow reverse record synchronization
     hosts: ipaserver
     become: true
   
     tasks:
     - name: Disallow reverse record synchronization.
       freeipa.ansible_freeipa.ipadnsconfig:
         ipaadmin_password: "{{ ipaadmin_password }}"
         allow_sync_ptr: no

   Copy to Clipboard
5. Save the file.

6. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory.file disallow-reverse-sync-copy.yml

   Copy to Clipboard