4.4. Generating a BIND TSIG Key

Procedure 4.1. To Generate a BIND TSIG Key:

1. The dnssec-keygen command, provided by the bind package, can be used to generate a TSIG key. Install the bind package on a host, if required:

   # yum install bind

   Copy to Clipboard Toggle word wrap

   Note

   The bind package is available in the Red Hat Enterprise Linux 6 Server base channel.
2. Configure the $domain environment variable to simplify the process in the following step, replacing Cloud_Domain with the domain name to suit your environment:

   # domain=Cloud_Domain# domain=Cloud_Domain

   Copy to Clipboard Toggle word wrap
3. Generate a TSIG key for your chosen cloud domain:

   # dnssec-keygen -a HMAC-MD5 -b 512 -n USER -r /dev/urandom -K /var/named $domain
   # cat /var/named/K$domain.*.key | awk '{print $8}'

   Copy to Clipboard Toggle word wrap
   The format for the TSIG key returned by the last command should resemble CNk+wjszKi9da9nL/1gkMY7H+GuUng==. This key is set in the bind_key Puppet parameter in later sections.
4. If you want your OpenShift Enterprise hosts to be in a separate domain than the zone used for applications hosted on OpenShift Enterprise, you can create a second TSIG key at this time as well:

   # infra_domain=Infrastructure_Domain# infra_domain=Infrastructure_Domain
   # dnssec-keygen -a HMAC-MD5 -b 512 -n USER -r /dev/urandom -K /var/named $infra_domain
   # cat /var/named/K$infra_domain.*.key | awk '{print $8}'

   Copy to Clipboard Toggle word wrap
   This key can be set in the dns_infrastructure_key Puppet parameter in later sections, if the dns_infrastructure_zone parameter is set.