Deploy DNS service components

Deploy the DNS service by enabling it in the OpenStackControlPlane custom resource and configuring the designate service components.

Before you begin

  • You have the oc command line tool installed on your workstation.
  • You are logged on to a workstation that has access to the RHOSO control plane as a user with cluster-admin privileges.

About this task

  1. Update the OpenStackControlPlane CR with the required values for the DNS service.

Procedure

  1. Open your OpenStackControlPlane CR file on your workstation, and enable the DNS service (designate) by adding the following: 
    designate:
  apiOverride:
    route: {}
  enabled: true
  template:
    nsRecords:
      - hostname: ns1.example.org.
        priority: 1
      - hostname: ns2.example.org.
        priority: 2
...
  2. Also in the OpenStackControlPlane CR file, add the following designate services configurations:
    designateAPI 
    ...
    designateAPI:
      networkAttachments:
      - internalapi
      override:
        service:
          internal:
            metadata:
              annotations:
                metallb.universe.tf/address-pool: internalapi
                metallb.universe.tf/allow-shared-ip: internalapi
                metallb.universe.tf/loadBalancerIPs: 172.17.0.80
            spec:
              type: LoadBalancer
...
    Note
    Ensure that the annotation values for designateAPI match the annotation values used for the other API services in the current OpenstackControlPlane CR.
    designateBackendbind9 
    ...
    designateBackendbind9:
      controlNetworkName: designate
      networkAttachments:
        - designate
      override:
        services:
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.80
            spec:
              type: LoadBalancer
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.81
            spec:
              type: LoadBalancer
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.82
            spec:
              type: LoadBalancer
      replicas: 3
      resources: {}
      serviceUser: designate
      storageClass: local-storage
      storageRequest: 10G
...
    Note
    Use a services override for each replica. In the above example, the replica count is 3 so there are 3 services defined. The network attachments might differ in a production system if an additional dedicated network is used to reach the BIND 9 servers.
    designateCentral 
    ...
    designateCentral:
      replicas: 3
...
    designateMdns 
    ...
    designateMdns:
      networkAttachments:
        - designate
      replicas: 3
...
    designateProducer 
    ...
    designateProducer:
      replicas: 3
...
    designateUnbound 
    ...
    designateUnbound:
      defaultConfigOverwrite:
        forwarders.conf: |
          forward-zone:
            name: "."
            forward-addr: 172.11.5.155
            forward-addr: 172.12.5.155
      networkAttachments:
        - designate
      override:
        services:
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.90
            spec:
              type: LoadBalancer
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.91
            spec:
              type: LoadBalancer
          - metadata:
              annotations:
                metallb.universe.tf/address-pool: designateext
                metallb.universe.tf/allow-shared-ip: designateext
                metallb.universe.tf/loadBalancerIPs: 172.34.0.93
            spec:
              type: LoadBalancer
      replicas: 3
      resources: {}
      stubZones:
        - name: example.org
        - name: anotherexample.org
...
    • name: Name of the forward zone. This is the full domain name of the zone.
    • forward-addr: <IP_address>: The IP address of the server to forward to. You can use an IP address in either IPv4 or IPv6 format. To use a non-default port for DNS communication, append an @ followed by the port number.
    • replicas - Use a services override for each replica. In the earlier example, the replica count is 3 so there are 3 services defined. The network attachments might differ in a production system if an additional dedicated network is used to reach the Unbound servers.
    • stubZones - An optional section in which you add zone names for the OpenStack Operator to automatically create stub zone records.
    designateWorker 
    ...
    designateWorker:
      databaseAccount: designate
      networkAttachments:
        - designate
      replicas: 3
...
  3. Optional: if you want to configure integration between the Networking service (neutron) and the DNS service, perform the following steps.

    For more information, see Configure project for automatic DNS records

    1. Locate the service definition for neutron, and add a customServiceConfig section: 
        neutron:
    template:
      customServiceConfig: |
    2. Under the customServiceConfig section, add a [DEFAULT] sub-section where you add the domain for your site.
      Example

      In this example, the DNS domain is example.org.. Change this value to the domain appropriate for your site. The value for external_dns_driver in most cases is designate:

        neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        dns_domain = example.org.
        external_dns_driver = designate
    3. Add an [ml2] sub-section and include dns_domain_keywords to the list of neutron extension drivers: 
        neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        dns_domain = example.org.
        external_dns_driver = designate
        [ml2]
        extension_drivers=qos,port_security,dns_domain_keywords
    4. Add a [designate] sub-section to customServiceConfig section.
      Example
        neutron:
    template:
      customServiceConfig: |
        [DEFAULT]
        dns_domain = example.org.
        external_dns_driver = designate
        [ml2]
        extension_drivers=qos,port_security,dns_domain_keywords
        [designate]
        url = https://designate-internal.openstack.svc:9001/v2
        auth_type = password
        auth_url =  {{ .KeystoneInternalURL }}
        username = {{ .ServiceUser }}
        password = {{ .ServicePassword }}
        project_name = service
        project_domain_name = Default
        user_domain_name = Default
        allow_reverse_dns_lookup = true
        ipv4_ptr_zone_prefix_size = 24
        ipv6_ptr_zone_prefix_size = 116
        ptr_zone_email = admin@example.org
      • url: the OpenStack DNS service public endpoint URL with the current version, v2.
      • auth_type: the authorization plugin to use, either password or token.
      • auth_url: the Identity service (keystone) authorization endpoint URL. The Networking service uses this endpoint to authenticate as a user to create and update reverse lookup zones.
      • username: the username the Networking service uses to create and update reverse lookup zones.
      • password: the password of the user that the Networking service uses to create and update reverse lookup zones.
      • project_name: the name of the project that the Networking service uses to create and update reverse lookup zones.
      • project_domain_name: the name of the domain for the project that the Networking service uses to create and update reverse lookup zones.
      • user_domain_name: the name of the domain for the user that the Networking service uses to create and update reverse lookup zones.
      • allow_reverse_dns_lookup: when true, enables the creation of reverse lookup records.
      • ipv4_ptr_zone_prefix_size: the size in bits of the prefix for the IPv4 reverse lookup zones.
      • ipv6_ptr_zone_prefix_size: the size in bits of the prefix for the IPv6 reverse lookup zones.
      • ptr_zone_email: the email address that the DNS service uses when creating new reverse lookup zones. The default is admin@<dns_domain> where <dns_domain> is the domain for the first record being created in that zone.
  4. Update the OpenStackControlPlane custom resource with the required values for the DNS service.
    Example
    $ oc apply -f openstack_control_plane.yaml -n openstack

Results

  1. Wait until RHOCP creates the DNS service resources. Run the following command to check the status: 
    $ oc wait designate designate --for condition=Ready
    Sample output
    designate.designate.openstack.org/designate condition met
  2. Confirm that the DNS service pods are running: 
    $ oc -n openstack get pods | grep -iE "(designate)"
    Sample output

    You should see output similar to the following:

    designate-api-7d8447bc98-cfl22           1/1     Running     0          10s
designate-backendbind9-0                 1/1     Running     0          15s
designate-backendbind9-1                 1/1     Running     0          20s
designate-backendbind9-2                 1/1     Running     0          22s
designate-central-86c558fb98-82bn2       1/1     Running     0          12s
designate-central-86c558fb98-0cxz1       1/1     Running     0          19s
designate-central-86c558fb98-vkj72       1/1     Running     0          12s
designate-mdns-0                         1/1     Running     0          13s
designate-mdns-1                         1/1     Running     0          11s
designate-mdns-2                         1/1     Running     0          15s
designate-producer-7f69498d75-6wlr8      1/1     Running     0          12s
designate-producer-7f69498d75-3sd55      1/1     Running     0          10s
designate-producer-7f69498d75-tvmr9      1/1     Running     0          12s
designate-redis-redis-0                  2/2     Running     0          11d
designate-unbound-0                      1/1     Running     0          18d
designate-unbound-1                      1/1     Running     0          11d
designate-unbound-2                      1/1     Running     0          16d
designate-worker-85596d67b6-7sbgw        1/1     Running     0          14d
designate-worker-85596d67b6-xkg49        1/1     Running     0          12d
designate-worker-85596d67b6-5ckje        1/1     Running     0          10d