Alex Monk has uploaded a new change for review.
https://gerrit.wikimedia.org/r/243357
Change subject: [WIP] Labs DNS: Stop hardcoding instance IPs in Puppet
......................................................................
[WIP] Labs DNS: Stop hardcoding instance IPs in Puppet
TODO:
* Don't restart DNS server every time Puppet runs.
* Change the script to be a simple file and separate pass/host config to a
template.
* Make sure python and python-novaclient are installed on the labs DNS hosts.
Change-Id: I260f219cb477270f5f5b5f59d35c1f1abc7cd930
---
M manifests/role/labsdns.pp
M modules/dnsrecursor/manifests/init.pp
D modules/dnsrecursor/templates/ip-alias.lua.erb
A templates/labsdns/ip-alias-dump.py.erb
4 files changed, 52 insertions(+), 97 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/57/243357/1
diff --git a/manifests/role/labsdns.pp b/manifests/role/labsdns.pp
index 968779d..af067c7 100644
--- a/manifests/role/labsdns.pp
+++ b/manifests/role/labsdns.pp
@@ -68,27 +68,21 @@
system::role { 'role::labsdnsrecursor': description => 'Recursive DNS
server for Labs instances' }
# We need to alias some public IPs to their corresponding private IPs.
- # FIXME: these should be automatically synced rather than hard-coded.
- $nova_floating_ip_aliases = {
- # eqiad
- 'deployment-cache-text04' => {public_ip => '208.80.155.135',
- private_ip => '10.68.18.103' },
- 'deployment-cache-upload04' => {public_ip => '208.80.155.136',
- private_ip => '10.68.18.109' },
- 'deployment-stream' => {public_ip => '208.80.155.138',
- private_ip => '10.68.17.106' },
- 'deployment-cache-mobile04' => {public_ip => '208.80.155.139',
- private_ip => '10.68.18.110' },
- 'relic' => {public_ip => '208.80.155.197',
- private_ip => '10.68.16.162' },
- 'tools-webproxy' => {public_ip => '208.80.155.131',
- private_ip => '10.68.21.81' },
- 'udplog' => {public_ip => '208.80.155.191',
- private_ip => '10.68.16.58' },
+ $wikitech_nova_ldap_user_pass =
$passwords::openstack::nova::nova_ldap_user_pass
+ $nova_controller_hostname = hiera('labs_nova_controller')
+ file { '/usr/local/bin/ip-alias-dump.py':
+ ensure => present,
+ owner => 'root',
+ group => 'root',
+ mode => '0551',
+ content => template('labsdns/ip-alias-dump.py.erb')
+ }
- # A wide variety of hosts are reachable via a public web proxy.
- 'labs_shared_proxy' => {public_ip => '208.80.155.156',
- private_ip => '10.68.16.65'},
+ exec { '/usr/local/bin/ip-alias-dump.py':
+ user => 'root',
+ group => 'root',
+ notify => Service['pdns-recursor'],
+ require => File['/usr/local/bin/ip-alias-dump.py']
}
$listen_addresses = $::realm ? {
@@ -101,7 +95,6 @@
class { ::dnsrecursor:
listen_addresses => $listen_addresses,
allow_from => $network::constants::all_networks,
- ip_aliases => $nova_floating_ip_aliases,
additional_forward_zones => "wmflabs=${labs_auth_dns},
68.10.in-addr.arpa=${labs_auth_dns}",
auth_zones => "labsdb=/var/zones/labsdb"
}
diff --git a/modules/dnsrecursor/manifests/init.pp
b/modules/dnsrecursor/manifests/init.pp
index 56257fe..3987e57 100644
--- a/modules/dnsrecursor/manifests/init.pp
+++ b/modules/dnsrecursor/manifests/init.pp
@@ -8,7 +8,6 @@
class dnsrecursor(
$listen_addresses = [$::ipaddress],
$allow_from = [],
- $ip_aliases = undef,
$additional_forward_zones = "",
$auth_zones = undef
) {
@@ -24,23 +23,6 @@
}
include network::constants
-
- $alias_script='/etc/powerdns/ip-alias.lua'
- if $ip_aliases {
- file { $alias_script:
- ensure => present,
- require => Package['pdns-recursor'],
- owner => 'root',
- group => 'root',
- mode => '0444',
- notify => Service['pdns-recursor'],
- content => template('dnsrecursor/ip-alias.lua.erb'),
- }
- } else {
- file { $alias_script:
- ensure => absent,
- }
- }
file { '/etc/powerdns/recursor.conf':
ensure => 'present',
diff --git a/modules/dnsrecursor/templates/ip-alias.lua.erb
b/modules/dnsrecursor/templates/ip-alias.lua.erb
deleted file mode 100644
index 3feab9e..0000000
--- a/modules/dnsrecursor/templates/ip-alias.lua.erb
+++ /dev/null
@@ -1,58 +0,0 @@
--- This script comes from puppet:
modules/dnsrecursor/templates/ip-alias.lua.erb.
--- It hooks the 'postresolve' hook in the pdns recursor and maps public labs
IPs
--- to the corresponding internal private IPs.
---
--- If you're looking at the generated file, bear in mind that the upcoming
table
--- was generated via puppet and .erb. If you're looking at the raw .erb
--- script, here's what's happening:
---
--- From puppet we're getting a fancy data structure like this:
--- {
--- 'deployment-cache-text04' => {public_ip => '208.80.155.135',
--- private_ip => '10.68.18.103' },
--- 'deployment-cache-upload04' => {public_ip => '208.80.155.136',
--- private_ip => '10.68.18.109' },
--- }
--- The following .erb magic pulls that apart and reconstructs it into a
--- lua table with entries like:
--- aliastable['deployment-cache-text04']['public_ip'] = '208.80.155.135'
--- aliastable['deployment-cache-text04']['private_ip'] = '10.68.18.103'
--- aliastable['deployment-cache-upload04']['public_ip'] =
'208.80.155.136'
--- aliastable['deployment-cache-upload04']['private_ip'] = '10.68.18.109'
---
--- In both cases the actual instance name is unused, but it's nice to have
around
--- for debugging purposes.
-
-aliastable = {}
-
-<% @ip_aliases.sort.each do |pair| -%>
-<%= "aliastable[\"#{pair[0]}\"] = {}\n" -%>
-<% pair[1].each do |address| -%>
-<%= "aliastable[\"#{pair[0]}\"][\"#{address[0]}\"] = \"#{address[1]}\"\n" -%>
-<% end -%>
-<% end -%>
-
--- Flatten our table into a simple mapping with entries like this:
--- aliasmapping['208.80.155.135'] = '10.68.18.103'
--- aliasmapping['208.80.155.136'] = '10.68.17.51'
-aliasmapping = {}
-for name,entries in pairs(aliastable) do
- aliasmapping[entries["public_ip"]] = entries["private_ip"]
-end
-
-
--- Finally, apply that mapping to any matches that are thrown
--- our way.
-function postresolve ( remoteip, domain, qtype, records, origrcode )
- -- print ("postresolve called for: ", remoteip, getlocaladdress(), domain,
qtype, origrcode)
-
- for key,val in ipairs(records)
- do
- if (aliasmapping[val.content] and val.qtype == pdns.A)
- then
- val.content = aliasmapping[val.content]
- setvariable()
- end
- end
- return origrcode, records
-end
diff --git a/templates/labsdns/ip-alias-dump.py.erb
b/templates/labsdns/ip-alias-dump.py.erb
new file mode 100644
index 0000000..9f3b532
--- /dev/null
+++ b/templates/labsdns/ip-alias-dump.py.erb
@@ -0,0 +1,38 @@
+username = 'novaadmin'
+password = '<%= @wikitech_nova_ldap_user_pass %>'
+projects = ['project-proxy', 'deployment-prep', 'tools', 'toolserver-legacy']
+# TODO: When we have a v3 Nova API, get a list of projects dynamically instead
of hardcoding them here.
+
+from novaclient import client as novaclient
+import json
+out = []
+for project in projects:
+ client = novaclient.Client("1.1", username, password, project,
'http://<%= @nova_controller_hostname %>:35357/v2.0')
+
+ for server in client.servers.list():
+ serverAddresses = {}
+ for address in server.addresses['public']:
+ if address['OS-EXT-IPS:type'] == 'floating':
+ serverAddresses['public_ip'] =
str(address['addr'])
+ elif address['OS-EXT-IPS:type'] == 'fixed':
+ serverAddresses['private_ip'] =
str(address['addr'])
+ if 'public_ip' in serverAddresses:
+ out.append((str(server.name),
serverAddresses['public_ip'], serverAddresses['private_ip']))
+
+with open('/etc/powerdns/ip-alias.lua', 'w') as f:
+ f.write("aliasmapping = {}\n")
+ for name, public, private in out:
+ f.write("aliasmapping[\"" + public + "\"] = \"" + private + "\"
# " + name + "\n")
+ f.write("""
+function postresolve ( remoteip, domain, qtype, records, origrcode )
+ for key,val in ipairs(records)
+ do
+ if (aliasmapping[val.content] and val.qtype == pdns.A)
+ then
+ val.content = aliasmapping[val.content]
+ setvariable()
+ end
+ end
+ return origrcode, records
+end
+""")
--
To view, visit https://gerrit.wikimedia.org/r/243357
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I260f219cb477270f5f5b5f59d35c1f1abc7cd930
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Alex Monk <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
