Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 1. Overview of DNSaaS
Red Hat OpenStack Platform includes a Technology Preview of DNS-as-a-Service (DNSaaS), also known as Designate. DNSaaS includes a REST API for domain and record management, is multi-tenanted, and integrates with OpenStack Identity Service (keystone) for authentication. DNSaaS includes a framework for integration with Compute (nova) and OpenStack Networking (neutron) notifications, allowing auto-generated DNS records. In addition, DNSaaS includes integration support for Bind9.
DNS-as-a-Service (DNSaaS), also known as Designate, is available in this release as a Technology Preview, and therefore is not fully supported by Red Hat. If you are interested in running DNSaaS in your production environment, please file a support ticket and mention the bug tracker BZ#1374002
, so we can gauge the interest for this tool. For more information about Technology Preview features, see https://access.redhat.com/support/offerings/techpreview.
1.1. Topics covered in this chapter Copier lienLien copié sur presse-papiers!
- Manual DNSaaS installation steps, as DNSaaS is not currently included in Director deployment.
- Managing and configuring DNSaaS from the command line interface.
- Integration with Bind9, including API usage and auto-creation of instance records.
1.1.1. DNSaaS prerequisites Copier lienLien copié sur presse-papiers!
- A fully functioning non-HA OpenStack environment.
1.1.2. DNSaaS services Copier lienLien copié sur presse-papiers!
A deployment of DNSaaS includes the following components:
designate-api | Provides an OpenStack-native REST API. |
designate-central | Handles requests and coordinates storage in the mysql database. |
designate-mdns | A small MiniDNS server used only to communicate with other DNS servers over standard DNS protocol. |
designate-pool-manager | Manages the states of the DNS servers that DNSaaS manages. Ensures the backend DNS servers are in sync with DNSaaS. |
designate-sink | An optional service that is used to listen to nova and neutron notification events to trigger automatic record creation/deletion. |
designate-agent | Used for DNS servers that cannot accept zone transfers (AXFR). Not needed for BIND backends. |
1.1.3. DNSaaS integration with Compute and OpenStack Networking Copier lienLien copié sur presse-papiers!
DNSaaS record management begins when the designate-sink
service sends a message to designate-central
, which then triggers the workflow described below:
-
designate-sink
receives an instance boot/delete event from Compute, or a floating IP add/remove event from OpenStack Networking. These events are sent using the OpenStack message bus. -
designate-sink
constructs the FQDN of the host from the VM name and the configured domain ID (see below). -
designate-sink
tellsdesignate-central
to add/delete the record with the given name and IP address. -
designate-central
adds/deletes the record in the DNSaaS database (shared betweendesignate-central
anddesignate-mdns
). -
designate-central
tellsdesignate-pool-manager
to send aDNS NOTIFY
to the backend DNS server (BIND9) for this domain. -
The backend DNS servers receive the
DNS NOTIFY
and send anAXFR
(zone transfer) request todesignate-mdns
. -
designate-mdns
reads the changes from the database and sends them to the backend DNS servers in theAXFR
response.
1.2. Manual DNSaaS installation Copier lienLien copié sur presse-papiers!
Your server must be registered to receive the OpenStack packages. For more information, see https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/10/html-single/director_installation_and_usage/#sect-Registering_your_System
Install the DNSaaS and BIND packages on the controller node. NOTE: You can also an external BIND service; you will need change the variables below accordingly.
yum install openstack-designate-api openstack-designate-central openstack-designate-sink openstack-designate-pool-manager openstack-designate-mdns openstack-designate-common python-designate python-designateclient openstack-designate-agent openstack-utils bind bind-utils
yum install openstack-designate-api openstack-designate-central openstack-designate-sink openstack-designate-pool-manager openstack-designate-mdns openstack-designate-common python-designate python-designateclient openstack-designate-agent openstack-utils bind bind-utils
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure DNS. It is important to define a specific boolean, otherwise you will get AVCs / Access denied in Designate when creating new zones:
setsebool named_write_master_zones 1
setsebool named_write_master_zones 1
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure ISC BIND to listen in all IP addresses:
sed -i -e "s/listen-on port.*/listen-on port 53 { any; };/" /etc/named.conf
sed -i -e "s/listen-on port.*/listen-on port 53 { any; };/" /etc/named.conf
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure
rndc
to bind in all IP addresses, accepts onlyrndc-key
key:sed -i '/^options.*/i include "/etc/rndc.key"; controls { inet * allow { any; } keys { "rndc-key"; }; };' /etc/named.conf
sed -i '/^options.*/i include "/etc/rndc.key"; controls { inet * allow { any; } keys { "rndc-key"; }; };' /etc/named.conf
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Allow queries for local DNS server from all IP addresses:
sed -i '/allow-query.*/d' /etc/named.conf
sed -i '/allow-query.*/d' /etc/named.conf
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure DNS server to permit new zone creation via
rndc
:sed -i '/^options.*/a allow-new-zones yes; allow-query { any; };' /etc/named.conf
sed -i '/^options.*/a allow-new-zones yes; allow-query { any; };' /etc/named.conf
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create
rndc
initial configuration:rndc-confgen -a
rndc-confgen -a
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Permit group
named
to write in/var/named
:chmod g+w /var/named
chmod g+w /var/named
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Fix
rndc
key permissions:chgrp named /etc/rndc.key chmod g+r /etc/rndc.key
chgrp named /etc/rndc.key chmod g+r /etc/rndc.key
Copy to Clipboard Copied! Toggle word wrap Toggle overflow And finally, start the DNS service:
systemctl enable named systemctl start named
systemctl enable named systemctl start named
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Source your
openstackrc
file, as the following steps interact with OpenStack services. To ease the deployment process, this guide relies on a number of variables; you will need to populate the values accordingly:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow The following variables will also populate the required IDs that will be used during the install process.
SERVICES_TENANT_ID=`openstack project show $SERVICES_PROJECT_NAME -f value -c id` INSTANCES_TENANT_ID=`openstack project show $INSTANCES_PROJECT_NAME -f value -c id` DEFAULT_NAMESERVER_ID=$(uuidgen) DEFAULT_TARGET_ID=$(uuidgen) INTERNAL_NET_ID=`openstack network show $INTERNAL_NET_NAME -f value -c id`
SERVICES_TENANT_ID=`openstack project show $SERVICES_PROJECT_NAME -f value -c id` INSTANCES_TENANT_ID=`openstack project show $INSTANCES_PROJECT_NAME -f value -c id` DEFAULT_NAMESERVER_ID=$(uuidgen) DEFAULT_TARGET_ID=$(uuidgen) INTERNAL_NET_ID=`openstack network show $INTERNAL_NET_NAME -f value -c id`
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create the backend database:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create the DNSaaS service account in keystone:
openstack user create designate --password $DESIGNATE_PASSWORD --email designate@localhost
openstack user create designate --password $DESIGNATE_PASSWORD --email designate@localhost
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Add the DNSaaS account to the
service
project:openstack role add --project $SERVICES_PROJECT_NAME --user designate admin
openstack role add --project $SERVICES_PROJECT_NAME --user designate admin
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create the DNSaaS service:
openstack service create dns --name designate --description "Designate DNS Service"
openstack service create dns --name designate --description "Designate DNS Service"
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create the DNSaaS endpoint:
openstack endpoint create --region RegionOne --publicurl http://$DESIGNATE_VIP_IP:9001 --internalurl http://$DESIGNATE_VIP_IP:9001 --adminurl http://$DESIGNATE_VIP_IP:9001 designate
openstack endpoint create --region RegionOne --publicurl http://$DESIGNATE_VIP_IP:9001 --internalurl http://$DESIGNATE_VIP_IP:9001 --adminurl http://$DESIGNATE_VIP_IP:9001 designate
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Add the keystone token settings to the DNSaaS configuration:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure the API extensions for DNSaaS:
crudini --set /etc/designate/designate.conf service:api enabled_extensions_v1 "diagnostics, quotas, reports, sync, touch" crudini --set /etc/designate/designate.conf service:api enabled_extensions_v2 "quotas, reports"
crudini --set /etc/designate/designate.conf service:api enabled_extensions_v1 "diagnostics, quotas, reports, sync, touch" crudini --set /etc/designate/designate.conf service:api enabled_extensions_v2 "quotas, reports"
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure DNSaaS to integrate with the
Instances
project:crudini --set /etc/designate/designate.conf service:central managed_resource_tenant_id $INSTANCES_TENANT_ID
crudini --set /etc/designate/designate.conf service:central managed_resource_tenant_id $INSTANCES_TENANT_ID
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Add the connection to the backend database:
crudini --set /etc/designate/designate.conf storage:sqlalchemy connection mysql+pymysql://designate:$DESIGNATE_PASSWORD@$MYSQL_SERVER_IP/designate crudini --set /etc/designate/designate.conf pool_manager_cache:sqlalchemy connection mysql+pymysql://designate:$DESIGNATE_PASSWORD@$MYSQL_SERVER_IP/designate_pool_manager
crudini --set /etc/designate/designate.conf storage:sqlalchemy connection mysql+pymysql://designate:$DESIGNATE_PASSWORD@$MYSQL_SERVER_IP/designate crudini --set /etc/designate/designate.conf pool_manager_cache:sqlalchemy connection mysql+pymysql://designate:$DESIGNATE_PASSWORD@$MYSQL_SERVER_IP/designate_pool_manager
Copy to Clipboard Copied! Toggle word wrap Toggle overflow And the Messaging endpoint:
crudini --set /etc/designate/designate.conf oslo_messaging_rabbit rabbit_hosts $RABBIT_SERVER_IP:5672
crudini --set /etc/designate/designate.conf oslo_messaging_rabbit rabbit_hosts $RABBIT_SERVER_IP:5672
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Populate and prepare the Designate MySQL database:
su -s /bin/sh -c "designate-manage database sync" designate su -s /bin/sh -c "designate-manage pool-manager-cache sync" designate
su -s /bin/sh -c "designate-manage database sync" designate su -s /bin/sh -c "designate-manage pool-manager-cache sync" designate
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Enable and start only the
central
andapi
designate services:systemctl enable designate-central designate-api systemctl start designate-central designate-api
systemctl enable designate-central designate-api systemctl start designate-central designate-api
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create the following file in
/etc/designate/pools.yaml
. Remember that you need to change the variablesEXTERNAL_DNS_SERVER_FQDN
,EXTERNAL_DNS_SERVER_IP
andDESIGNATE_SERVER_1
. There are provisions for additional DNS servers, if needed:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Copy the
rndc
keyfile to/etc/designate
:cp -f /etc/rndc.key /etc/designate/rndc.key
cp -f /etc/rndc.key /etc/designate/rndc.key
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Ensure
designate
owns it:chown designate:designate /etc/designate/rndc.key
chown designate:designate /etc/designate/rndc.key
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Load the above YAML file into the DNSaaS runtime configuration:
su -s /bin/sh -c "designate-manage pool update" designate
su -s /bin/sh -c "designate-manage pool update" designate
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Start the remaining DNSaaS services:
systemctl enable designate-pool-manager designate-mdns designate-sink systemctl start designate-pool-manager designate-mdns designate-sink
systemctl enable designate-pool-manager designate-mdns designate-sink systemctl start designate-pool-manager designate-mdns designate-sink
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create a DNS zone and export the
ZONE_ID
variable after its creation:ZONE_ID=`openstack zone create --email admin@$ZONE_NAME $ZONE_NAME. -f value -c id`
ZONE_ID=`openstack zone create --email admin@$ZONE_NAME $ZONE_NAME. -f value -c id`
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Add the UUID of the new zone to the nova and neutron handlers:
crudini --set /etc/designate/designate.conf handler:nova_fixed domain_id $ZONE_ID crudini --set /etc/designate/designate.conf handler:neutron_floatingip domain_id $ZONE_ID
crudini --set /etc/designate/designate.conf handler:nova_fixed domain_id $ZONE_ID crudini --set /etc/designate/designate.conf handler:neutron_floatingip domain_id $ZONE_ID
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Restart the DNSaaS services:
systemctl restart designate-api designate-central designate-mdns designate-pool-manager designate-sink
systemctl restart designate-api designate-central designate-mdns designate-pool-manager designate-sink
Copy to Clipboard Copied! Toggle word wrap Toggle overflow The DNSaaS portion is now fully configured. Next, you will configure neutron integration. Add
dns
to the list of ML2 drivers. For example:crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security,dns
crudini --set /etc/neutron/plugins/ml2/ml2_conf.ini ml2 extension_drivers port_security,dns
Copy to Clipboard Copied! Toggle word wrap Toggle overflow If you want your DNS agent (
dnsmasq
) to query DNSaaS (it does not by default):crudini --set /etc/neutron/dhcp_agent.ini DEFAULT dnsmasq_dns_servers $EXTERNAL_DNS_SERVER_IP
crudini --set /etc/neutron/dhcp_agent.ini DEFAULT dnsmasq_dns_servers $EXTERNAL_DNS_SERVER_IP
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Enable DNSaaS integration for neutron:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Restart the neutron and nova services:
openstack-service restart neutron openstack-service restart nova
openstack-service restart neutron openstack-service restart nova
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Configure your neutron network to use DNSaaS:
neutron net-update $INTERNAL_NET_ID --dns_domain $ZONE_NAME.
neutron net-update $INTERNAL_NET_ID --dns_domain $ZONE_NAME.
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
1.3. Test OpenStack Networking floating IP record creation Copier lienLien copié sur presse-papiers!
Check that the zone is correctly configured and in an
ACTIVE
state:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Enumerate the existing networks to retrieve the UUIDs. These will be used in the later steps. This example uses the
internal
andexternal
networks:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create a instance named
testinstance
, using base image namedweb
, flavorm1.small
, attached to networkinternal
, with SSH keypairkeypair-demo
:openstack server create --image web --flavor m1.small --nic net-id=c020e6a9-f483-48a9-893d-983ae23d248a --key-name keypair-demo -f value -c id testinstance
$ openstack server create --image web --flavor m1.small --nic net-id=c020e6a9-f483-48a9-893d-983ae23d248a --key-name keypair-demo -f value -c id testinstance 14e1d0da-30bd-4adf-927b-8f54932cbe95
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Confirm that your instance enters the
ACTIVE
state before proceeding:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Review the DNSaaS records and confirm that the new instance does not yet have a record:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Create a floating IP address in the
external
network.---- $ openstack floating ip create -f value -c floating_ip_address 0efce5d7-b2ec-4877-b6bb-de339a76c80b 172.25.250.146
---- $ openstack floating ip create -f value -c floating_ip_address 0efce5d7-b2ec-4877-b6bb-de339a76c80b 172.25.250.146
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Copy to Clipboard Copied! Toggle word wrap Toggle overflow Attach the floating IP to
testinstance
:openstack server add floating ip 14e1d0da-30bd-4adf-927b-8f54932cbe95 172.25.250.146
$ openstack server add floating ip 14e1d0da-30bd-4adf-927b-8f54932cbe95 172.25.250.146
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check DNSaaS records. This example shows an RR entry for
testinstance.testzone.example.com
, in aPENDING
state.Copy to Clipboard Copied! Toggle word wrap Toggle overflow After a few seconds wait, you can expect the newly-created entry to change to
ACTIVE
:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Use the DNSaaS Designate API to create a manual record. This example creates
web.testzone.example.com
as an alias totestinstance.testzone.example.com
:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check the DNSaaS configuration. It should now contain a record for
web.testzone.example.com
:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Run a DNS test, pointing to
localhost
as the DNS server, as this is where the DNSaaS service actually runs. This example attempts to resolveweb.testzone.example.com
:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check the reverse DNS configuration:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
For more information, refer to the OpenStack Designate API V2 client documentation.