Puppet Class: profile::openstack::base::pdns::recursor::service

Defined in:
modules/profile/manifests/openstack/base/pdns/recursor/service.pp

Overview

Parameters:

  • keystone_api_fqdn (Stdlib::Fqdn) (defaults to: lookup('profile::openstack::base::keystone_api_fqdn'))
  • observer_user (Any) (defaults to: hiera('profile::openstack::base::observer_user'))
  • observer_password (Any) (defaults to: hiera('profile::openstack::base::observer_password'))
  • observer_project (Any) (defaults to: hiera('profile::openstack::base::observer_project'))
  • pdns_host (Any) (defaults to: hiera('profile::openstack::base::pdns::host'))
  • pdns_recursor (Any) (defaults to: hiera('profile::openstack::base::pdns::recursor'))
  • tld (Any) (defaults to: hiera('profile::openstack::base::pdns::tld'))
  • private_reverse_zones (Any) (defaults to: hiera('profile::openstack::base::pdns::private_reverse_zones'))
  • aliaser_extra_records (Any) (defaults to: hiera('profile::openstack::base::pdns::recursor_aliaser_extra_records'))


21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# File 'modules/profile/manifests/openstack/base/pdns/recursor/service.pp', line 21

class profile::openstack::base::pdns::recursor::service(
    Stdlib::Fqdn $keystone_api_fqdn = lookup('profile::openstack::base::keystone_api_fqdn'),
    $observer_user = hiera('profile::openstack::base::observer_user'),
    $observer_password = hiera('profile::openstack::base::observer_password'),
    $observer_project = hiera('profile::openstack::base::observer_project'),
    $pdns_host = hiera('profile::openstack::base::pdns::host'),
    $pdns_recursor = hiera('profile::openstack::base::pdns::recursor'),
    $tld = hiera('profile::openstack::base::pdns::tld'),
    $private_reverse_zones = hiera('profile::openstack::base::pdns::private_reverse_zones'),
    $aliaser_extra_records = hiera('profile::openstack::base::pdns::recursor_aliaser_extra_records'),
    ) {

    include ::network::constants
    $all_networks = flatten([$::network::constants::production_networks, $::network::constants::labs_networks])

    $pdns_host_ip = ipresolve($pdns_host,4)
    $pdns_recursor_ip = ipresolve($pdns_recursor,4)

    interface::alias { $title:
        ipv4 => $pdns_recursor_ip,
    }

    #  We need to alias some public IPs to their corresponding private IPs.
    $aliaser_source = 'puppet:///modules/profile/openstack/base/pdns/recursor/labsaliaser.lua'

    $aliaser_file = '/etc/powerdns/labs-ip-aliaser.lua'
    file { $aliaser_file:
        owner  => 'root',
        group  => 'root',
        mode   => '0555',
        source => $aliaser_source,
    }
    $lua_hooks = [$aliaser_file]

    file { '/var/zones':
        ensure => directory,
        owner  => 'root',
        group  => 'root',
        mode   => '0444'
    }

    file { '/var/zones/labsdb':
        ensure  => present,
        owner   => 'root',
        group   => 'root',
        mode    => '0444',
        source  => 'puppet:///modules/profile/openstack/base/pdns/recursor/labsdb.zone',
        notify  => Service['pdns-recursor'],
        require => File['/var/zones']
    }

    $reverse_zone_rules = inline_template("<% @private_reverse_zones.each do |zone| %><%= zone %>=${pdns_host_ip}, <% end %>")

    class { '::dnsrecursor':
            listen_addresses         => [$pdns_recursor_ip],
            allow_from               => $all_networks,
            additional_forward_zones => "${tld}=${pdns_host_ip}, ${reverse_zone_rules}",
            auth_zones               => 'labsdb=/var/zones/labsdb',
            lua_hooks                => $lua_hooks,
            max_negative_ttl         => 900,
            max_tcp_per_client       => 10,
            max_cache_entries        => 3000000,
            client_tcp_timeout       => 1,
            dnssec                   => 'off',  # T226088 - off until 4.1.x
            require                  => Interface::Alias[$title]
    }

    class { '::dnsrecursor::labsaliaser':
        username              => $observer_user,
        password              => $observer_password,
        nova_api_url          => "http://${keystone_api_fqdn}:5000/v3",
        extra_records         => $aliaser_extra_records,
        observer_project_name => $observer_project,
    }

    ferm::service { 'recursor_udp_dns_rec':
        proto  => 'udp',
        port   => '53',
        srange => '$LABS_NETWORKS',
    }

    ferm::service { 'recursor_tcp_dns_rec':
        proto  => 'tcp',
        port   => '53',
        srange => '$LABS_NETWORKS',
    }

    ferm::rule { 'recursor_skip_dns_conntrack-out':
        desc  => 'Skip DNS outgoing connection tracking',
        table => 'raw',
        chain => 'OUTPUT',
        rule  => 'proto udp sport 53 NOTRACK;',
    }

    ferm::rule { 'recursor_skip_dns_conntrack-in':
        desc  => 'Skip DNS incoming connection tracking',
        table => 'raw',
        chain => 'PREROUTING',
        rule  => 'proto udp dport 53 NOTRACK;',
    }

    ::dnsrecursor::monitor { $pdns_recursor_ip: }
}