console_url and dns for stack-lb.example.com wrong about openshift-on-openstack HOT 4 CLOSED

Could you please paste content of /var/lib/ansible/host_vars/loadbalancer.yml file on infra node?

from openshift-on-openstack.

Nvm, I have a reproducer.

from openshift-on-openstack.

Remote query denied. Useless to clients.

Jun  2 17:37:21 localhost named[9493]: client 192.168.191.44#61102 (ossdell-lb.example.com): query 'ossdell-lb.example.com/A/IN' denied
Jun  2 17:37:21 localhost named[9493]: client 192.168.191.44#61779 (ossdell-lb.example.com): query 'ossdell-lb.example.com/A/IN' denied

[root@ossdell-infra log]# cat /etc/named.conf
options
{
    directory "/var/named";

    allow-query { 192.168.0.0/24; };

    recursion yes;

    forwarders {
                8.8.4.4;
                8.8.8.8;
            };
};

zone "example.com" IN {
    type master;
    file "openshift-cluster.zone";
};
[root@ossdell-infra log]#

Why should allow-query be so narrow? Need to allow queries and answers for appropriate clients. I.e., "inside" queries and "outside" queries.

from openshift-on-openstack.

Hi, the purpose of the DNS server is purely internal - serve node DNS queries. The only outside entry point should be loadbalancer's hostname/ip which are both part of the heat stack output. I think we should allow automated update of the real external DNS server (this step is now manual) rather than exposing the internal DNS.

FWIW the named.conf template is part of openshift-ansible dns role - https://github.com/openshift/openshift-ansible/blob/master/roles/dns/templates/named.conf#L5

from openshift-on-openstack.