Page MenuHomePhabricator

sre.dns.netbox cookbook dosn't support period terminated domains
Open, MediumPublic

Description

When adding names to prefixes such as on https://netbox.wikimedia.org/ipam/prefixes/34/ip-addresses/. if a user enters a fully qualified *and terminated* domain i.e. the domain ends with a period, into the hostname field then sre.dns.netbox generates reverse zones with a double period.

See the following diff after removing a period from some offending names

diff --git a/32-27.153.80.208.in-addr.arpa b/32-27.153.80.208.in-addr.arpa                                          
index 848c67c..c50f1c1 100644                                                                                       
--- a/32-27.153.80.208.in-addr.arpa                                                                                 
+++ b/32-27.153.80.208.in-addr.arpa                                                                                 
@@ -10,10 +10,10 @@                                                                                                 
 44  1H IN PTR cloudservices2005-dev.wikimedia.org.                                                                 
 45  1H IN PTR mx2001.wikimedia.org.                                                                                
 46  1H IN PTR wiki-mail-codfw.wikimedia.org.                                                                       
-47  1H IN PTR ns-recursor0.openstack.codfw1dev.wikimediacloud.org..                                                
+47  1H IN PTR ns-recursor0.openstack.codfw1dev.wikimediacloud.org.                                                 
 48  1H IN PTR ldap-corp2001.wikimedia.org.                                                                         
 49  1H IN PTR serpens.wikimedia.org.                                                                               
-50  1H IN PTR ns-recursor0.openstack.codfw1dev.wikimediacloud.org..                                                
+50  1H IN PTR ns-recursor0.openstack.codfw1dev.wikimediacloud.org.                                                 
 51  1H IN PTR install2003.wikimedia.org.                                                                           
 54  1H IN PTR bast2002.wikimedia.org.                                                                              
 55  1H IN PTR vl2002-enp59s0f1d1.lvs2007.codfw.wmnet.                                                              
diff --git a/org.-codfw b/org.-codfw                                                                                
index 1f1a321..e8914e7 100644                                                                                       
--- a/org.-codfw                                                                                                    
+++ b/org.-codfw                                                                                                    
@@ -1,4 +1,2 @@                                                                                                     
-ns-recursor0.openstack.codfw1dev.wikimediacloud 1H IN A 208.80.153.47                                              
-ns-recursor0.openstack.codfw1dev.wikimediacloud 1H IN A 208.80.153.50                                              
 ns-recursor0.openstack.codfw1dev.wikimediacloud 1H IN AAAA 2620:0:860:3:208:80:153:47                              
 ns-recursor1.openstack.codfw1dev.wikimediacloud 1H IN AAAA 2620:0:860:3:208:80:153:50                              
diff --git a/wikimediacloud.org-codfw b/wikimediacloud.org-codfw                                                    
index 710ae1f..67a0372 100644                                                                                       
--- a/wikimediacloud.org-codfw                                                                                      
+++ b/wikimediacloud.org-codfw                                                                                      
@@ -3,3 +3,5 @@ wan.cloudgw.codfw1dev                    1H IN A 208.80.153.190                                     
 cloudgw2001-dev.codfw1dev                1H IN A 208.80.153.188                                                    
 cloudgw2002-dev.codfw1dev                1H IN A 208.80.153.189                                                    
 cloudinstances2b-gw.openstack.codfw1dev  1H IN A 185.15.57.10                                                      
+ns-recursor0.openstack.codfw1dev         1H IN A 208.80.153.47                                                     
+ns-recursor0.openstack.codfw1dev         1H IN A 208.80.153.50    

Event Timeline

jbond triaged this task as Medium priority.Apr 25 2022, 3:30 PM
jbond created this task.
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

The DNS Name field in Netbox is an FQDN, the same Netbox UI help message for the field is: Hostname or FQDN (not case-sensitive)
For this reason I think that this task should be closed as invalid, and instead we should move towards having consistent data in Netbox.
The DNS Name field is used in multiple places in different automation, from Homer to various Netbox scripts and is always considered to be an FQDN.

Im not sure i understand this response. The value entered which caused an error was ns-recursor0.openstack.codfw1dev.wikimediacloud.org. instead of ns-recursor0.openstack.codfw1dev.wikimediacloud.org both are valid FQDN and strictly speaking the one with the terminating period is the more correct form.

Sure, but they could cause various unwanted issues in different contexes, like not matching the fingerprint in the known hosts file for SSH connections:

cumin1001 $ SSH_AUTH_SOCK=/run/keyholder/proxy.sock ssh root@sretest1001.eqiad.wmnet.
The authenticity of host 'sretest1001.eqiad.wmnet. (2620:0:861:107:10:64:48:138)' can't be established.
[...SNIP...]

That's why I would rather prefer to keep the data consistent in Netbox without the ending period, so that the behaviour is consistent everywhere. For the DNS -specific bits the period is automatically added always.
Thoughts?

jbond changed the task status from Open to Stalled.Apr 26 2022, 9:58 AM

As per an offline conversation with @Volans. newer versions of netbox allow us to preform custom data validations as such i'm going to set this ticket to stalled until we upgrade netbox to at least version 3.0

ayounsi changed the task status from Stalled to Open.Jun 24 2022, 7:45 AM