Instances of the Beta Cluster and the Continuous Integration projects, have to resolve public DNS records such as en.wikipedia.beta.wmflabs.org . By default dnsmasq (and Designate) yield the public IP which is not reacheable by instances due to NAT.
To workaround it, Brandon Black added aliases in dnsmasq which causes it to yield the internal private IP when the entries are queried from labs instance. This way host resolving the public DNS entry ends up with the private IP.
The related puppet configuration is in operations/puppet.git modules/openstack/manifests/nova/network.pp
```
lang=ruby
$nova_dnsmasq_aliases = {
# eqiad
'deployment-cache-text02' => {public_ip => '208.80.155.135',
private_ip => '10.68.16.16' },
'deployment-cache-upload02' => {public_ip => '208.80.155.136',
private_ip => '10.68.17.51' },
'deployment-cache-bits01' => {public_ip => '208.80.155.137',
private_ip => '10.68.16.12' },
'deployment-stream' => {public_ip => '208.80.155.138',
private_ip => '10.68.17.106' },
'deployment-cache-mobile03' => {public_ip => '208.80.155.139',
private_ip => '10.68.16.13' },
'relic' => {public_ip => '208.80.155.197',
private_ip => '10.68.16.162' },
'tools-webproxy' => {public_ip => '208.80.155.131',
private_ip => '10.68.17.145' },
'udplog' => {public_ip => '208.80.155.191',
private_ip => '10.68.16.58' },
# A wide variety of hosts are reachable via a public web proxy.
'labs_shared_proxy' => {public_ip => '208.80.155.156',
private_ip => '10.68.16.65'},
}
```
Both the Beta cluster and the Continuous integration projects require that functionality. That is hardcoded in dnsmasq but maybe Designate natively supports split horizon (ie yield different results based on client).