Adopt the DNS service

To adopt the DNS service (designate), you patch an existing OpenStackControlPlane custom resource (CR) where the DNS service is disabled. The patch starts the service with the configuration parameters that are provided by the Red Hat OpenStack Platform (RHOSP) environment.

Procedure

  1. Create an alias for the openstack command: 
    $ alias openstack="oc exec -t openstackclient -- openstack"
  2. To isolate the DNS service networks, add the network interfaces for the VLAN base interfaces: 
    $ oc get --no-headers nncp --output=custom-columns='NAME:.metadata.name' | while read; do

interfaces=$(oc get nncp $REPLY -o jsonpath="{.spec.desiredState.interfaces[*].name}")

(echo $interfaces | grep -w -q "enp6s0.25\|enp6s0.26") || \
        oc patch nncp $REPLY --type json --patch '
[{
    "op": "add",
    "path": "/spec/desiredState/interfaces/-",
    "value": {
      "description": "Designate vlan interface",
      "name": "enp6s0.25",
      "state": "up",
      "type": "vlan",
      "vlan": {
        "base-iface": "<enp6s0>",
        "id": 25,
        "reorder-headers": true
      },
      "ipv4": {
        "address": [{"ip": "172.28.0.5", "prefix-length": 24}],
        "enabled": true,
        "dhcp": false
      },
      "ipv6": {
        "enabled": false
      }
    }
},
{
    "op": "add",
    "path": "/spec/desiredState/interfaces/-",
    "value": {
      "description": "Designate external vlan interface",
      "name": "enp6s0.26",
      "state": "up",
      "type": "vlan",
      "vlan": {
        "base-iface": "<enp6s0>",
        "id": 26,
        "reorder-headers": true
      },
      "ipv4": {
        "address": [{"ip": "172.50.0.5", "prefix-length": 24}],
        "enabled": true,
        "dhcp": false
      },
      "ipv6": {
        "enabled": false
      }
    }
}]'

done

    where:

    <enp6s0>
    Specifies the name of the network interface in your Red Hat OpenShift Container Platform (RHOCP) setup.
  3. Configure the DNS service internal network attachment definition: 
    $ cat >> designate-nad.yaml << EOF_CAT
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: designate
  name: designate
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "designate",
      "type": "macvlan",
      "master": "enp6s0.25",
      "ipam": {
        "type": "whereabouts",
        "range": "172.28.0.0/24",
        "range_start": "172.28.0.30",
        "range_end": "172.28.0.70"
      }
    }
EOF_CAT
  4. Apply the configuration: 
    $ oc apply -f designate-nad.yaml
  5. Configure the DNS service external network attachment definition: 
    $ cat >> designateext-nad.yaml << EOF_CAT
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  labels:
    osp/net: designateext
  name: designateext
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "designateext",
      "type": "macvlan",
      "master": "enp6s0.26",
      "ipam": {
        "type": "whereabouts",
        "range": "172.50.0.0/24",
        "range_start": "172.50.0.30",
        "range_end": "172.50.0.70"
      }
    }
EOF_CAT
  6. Apply the configuration: 
    $ oc apply -f designateext-nad.yaml
  7. Create a MetalLB IPAddressPool for the DNS service external network: 
    $ oc apply -f - <<EOF
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: designateext
  namespace: metallb-system
spec:
  autoAssign: false
  addresses:
  - 172.50.0.80-172.50.0.90
EOF
  8. Create an L2Advertisement for the DNS service external network: 
    $ oc apply -f - <<EOF
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: designateext
  namespace: metallb-system
spec:
  ipAddressPools:
  - designateext
  interfaces:
  - enp6s0.26
EOF
  9. Retrieve the name server records from the DNS service database to preserve DNS delegation: 
    $ DB_ROOT_PASSWORD=$(oc get -o json secret/osp-secret | jq -r .data.DbRootPassword | base64 -d)
$ oc exec openstack-galera-0 -c galera -- mysql -rs -uroot -p"$DB_ROOT_PASSWORD" \
    -e "select a.hostname, a.priority from designate.pool_ns_records a;" > /tmp/designate_ns_records_raw.txt
  10. Parse the name server records into YAML format for the DNS service CR: 
    $ raw=/tmp/designate_ns_records_raw.txt
$ out=/tmp/designate_ns_records.yaml
$ if [ ! -s "$raw" ]; then
  echo "[]" > "$out"
else
  awk '{ gsub(/\.$/, "", $1); if (NF >= 2) printf "- hostname: %s.\n  priority: %s\n", $1, $2 }' "$raw" > "$out"
fi
  11. Enable the DNS service Redis instance in {rhocp_short}: 
    $ oc patch openstackcontrolplane openstack --type=merge --patch '
spec:
  redis:
    enabled: true
    templates:
      designate-redis:
        replicas: 1
'
  12. Wait for the DNS service Redis instance to become ready: 
    $ oc wait --for condition=Ready --timeout=60s redises.redis.openstack.org/designate-redis
  13. Create the DNS service CR patch file: 
    $ cat > /tmp/designate_osp_patch.yaml << 'MAINCR'
spec:
  designate:
    enabled: true
    template:
      designateAPI:
        networkAttachments:
          - internalapi
      designateWorker:
        networkAttachments:
          - designate
        replicas: 3
      designateCentral:
        replicas: 3
      designateProducer:
        replicas: 3
      designateBackendbind9:
        networkAttachments:
          - designate
        override:
          services:
            - metadata:
                annotations:
                  metallb.universe.tf/address-pool: designateext
                  metallb.universe.tf/allow-shared-ip: designateext
                  metallb.universe.tf/loadBalancerIPs: 172.50.0.80
            - metadata:
                annotations:
                  metallb.universe.tf/address-pool: designateext
                  metallb.universe.tf/allow-shared-ip: designateext
                  metallb.universe.tf/loadBalancerIPs: 172.50.0.81
            - metadata:
                annotations:
                  metallb.universe.tf/address-pool: designateext
                  metallb.universe.tf/allow-shared-ip: designateext
                  metallb.universe.tf/loadBalancerIPs: 172.50.0.82
        replicas: 3
        storageClass: <storage_class>
        storageRequest: 10G
      designateMdns:
        networkAttachments:
          - designate
        replicas: 3
      designateUnbound:
        networkAttachments:
          - designate
        replicas: 2
        override:
          services:
            - metadata:
                annotations:
                  metallb.universe.tf/address-pool: designateext
                  metallb.universe.tf/allow-shared-ip: designateext
                  metallb.universe.tf/loadBalancerIPs: 172.50.0.85
            - metadata:
                annotations:
                  metallb.universe.tf/address-pool: designateext
                  metallb.universe.tf/allow-shared-ip: designateext
                  metallb.universe.tf/loadBalancerIPs: 172.50.0.86
MAINCR

    where:

    <storage_class>
    Specifies the storage class name for persistent volumes (for example, local-storage).
  14. Append the name server records to the patch file: 
    $ ns_yaml=/tmp/designate_ns_records.yaml
$ patch_file=/tmp/designate_osp_patch.yaml
$ echo '      nsRecords:' >> "$patch_file"
$ if [ -s "$ns_yaml" ] && [ "$(cat "$ns_yaml")" != "[]" ]; then
  sed 's/^/        /' "$ns_yaml" >> "$patch_file"
else
  echo '        []' >> "$patch_file"
fi
  15. Enable the DNS service in RHOCP: 
    $ oc patch openstackcontrolplane openstack --type=merge --patch-file /tmp/designate_osp_patch.yaml
  16. Wait for the DNS service to become ready: 
    $ oc wait --for condition=Ready --timeout=600s designate.designate.openstack.org/designate