fix: Stop gateway DNS dual-write for v4/v6 aliases - #316
Conversation
ExternalDNS was emitting A/AAAA for v4./v6. aliases while Gateway DNS also created CNAMEs at the same FQDNs, which PowerDNS rejects with 422. A Domain NS flap then GC'd those CNAMEs and recreated them into the conflict, hot-looping dnsrecordset-powerdns. Key changes: - ExternalDNS DNSEndpoint covers the apex only; v4./v6. stay CNAME-owned - Authority / verification misses retain desired DNSRecordSets (no GC) - Conflict detection blocks any other managed record at the same FQDN Fixes #315
mattdjenkinson
assigned
ecv,
savme and
JoseSzycho and unassigned
ecv,
savme and
JoseSzycho
|
I'm sorry for this one, I don't really have the knowledge to help with this review |
|
I feel like ExternalDNS should maybe be the sole writer? Then the responsibility isn't split. Point a contextless Opus model at this and ask it if the implementation has more elegant alternatives. I think there's also a few code issues w/ the unverifiedDomain retain branch never being traversed and retain-on-flap retaining forever, but these may be moot if we want ExternalDNS to do this. We might want to merge a guidance-and-reasoning doc on what bits should handle what, first, and then the code. |
|
I'd agree we should make sure there's an architecture doc we're working from that captures the responsibilities of each component in the system and make sure that's well understood here before we make a change. It's helpful to rationalize these types of situations where there's dual ownership over something. |
|
@ecv @scotwells yeah sure thing. Let me take this away and work on it. |
5 participants
Summary
Gateway
v4./v6.hostnames were getting two writers: ExternalDNS A/AAAA via the downstream DNSEndpoint, and Gateway DNS CNAMEs to the apex. PowerDNS rejects that mix with a 422, anddnsrecordset-powerdnsretries forever. Staging hit this on projectdatum-cloudafter a Domain NS flap deleted then recreated the CNAMEs into still-present A/AAAA records (see #315).This makes Gateway DNS the only writer for those aliases. ExternalDNS keeps the apex A/AAAA only. When Domain verification or DNS authority is temporarily missing, we still keep the hostname in the desired set so GC does not delete a record the Gateway still wants. Conflict detection now treats any other managed DNSRecordSet at the same FQDN/zone as a blocker, not only a different
managed-by.Test plan
managed-bysurfaces Conflict (no second record)v4./v6.claimed hostnames create CNAMEs to the canonical hostnamegatewayDNSEndpointEntriesemits apex A/AAAA onlygo test ./internal/controller/ -run 'DNS|GarbageCollectDNS|Reap'v4./v6.Hostname addressesFixes #315