4

I have set up an instance of redhat’s Openshift origin and am sometimes having troubles resolving the individual apps’ domains from the outside.

I have two physical machines running, both with their own public IP address. One is set up as broker (broker.cloud.example.com), the other one is an openshift node (node-1.cloud.example.com). I’ve installed openshift origin using the oo-install tool. oo-install set up bind on the broker.

The apps are running on their own domain (let’s call it example-cloud.com), thus their names are «app»-«namespace».example-cloud.com. The bind on the broker resolves this correctly to CNAME node-1.cloud.example.com.. I’ve set up the broker to be the authoritative server for example-cloud.com. The broker is NOT responsible for the example.com or the cloud.example.com zone.

Most of the time this setup works fine. Sometimes, however, apps’ names do not resolve. What I’ve found out using dig is that in these cases the query (to my ISP’s DNS server) yields the following:

;; ANSWER SECTION:
«app»-«namespace».example-cloud.com. 14400  IN CNAME node-1.cloud.example.com.

whereas in the normal case (when resolving works fine) the answer section contains an additional line:

;; ANSWER SECTION:
«app»-«namespace».example-cloud.com. 14400  IN CNAME node-1.cloud.example.com.
node-1.cloud.example.com. 14400 IN  A   x.x.x.x

When I ask the broker directly, I only get the former (which leads me to believe it’s configured incorrectly). If I enable recursive queries on the broker’s bind instance, I get the latter.

But I heard servers that answer recursive queries are dangerous so I disabled it again (hence my question about the differences between recursive and forwarding).

So I guess my questions are as follows:

  1. Do I have a misconfigured bind on the broker.
    1. If so…
      1. how do I fix it?
      2. is there a way to allow recursive queries for *.cloud.example.com but not other domains?
      3. is this a bug in oo-install?
    2. If not…
      1. might the DNS for cloud.example.com be faulty?
      2. how do I test for that?
  2. Or, formulated in an openshift-agnostic way (because there might be more DNS specialists than openshift specialists out there): if a server is authoritative for a zone and it returns a CNAME in another zone, does it need to (recursively) resolve that, too?

Update

Running oo-accept-broker on the broker yields

PASS

Bind config files

cat /etc/named.conf

// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
    listen-on port 53 { any; };
    directory "/var/named";
    dump-file "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query { any; };

    // NOTE: I’ve added the public IP addresses of the broker and the node to this list.
    // This is where I put “any” to “enable recursive queries on the broker’s bind instance” (see above)
    allow-recursion {x.x.x.x;y.y.y.y;"localhost";"localnets";};

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    // set forwarding to the next nearest server (from DHCP response
    forward only;
    include "forwarders.conf";
};

logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};

// use the default rndc key
include "/etc/rndc.key";

controls {
    inet 127.0.0.1 port 953
    allow { 127.0.0.1; } keys { "rndc-key"; };
};

include "/etc/named.rfc1912.zones";

include "example-cloud.com.key";

zone "example-cloud.com" IN {
    type master;
    file "dynamic/example-cloud.com.db";
    allow-update { key example-cloud.com ; } ;
};

// create a place for openshift infrastructure ip/name mapping
include "oo_infrastructure.conf";

cat /var/named/oo_infrastructure.conf

// no openshift infrastructure zone
5
  • 1
    Did you check the bind log?
    – 030
    Jan 30, 2015 at 18:26
  • 1
    Please add the bind configuration files
    – 030
    Jan 30, 2015 at 18:27
  • 1
    Also, please provide the actual domain names being used. Jan 31, 2015 at 15:02
  • @utrecht I’ve added named.conf. If there’s anything else you need, please tell me. Feb 4, 2015 at 9:03
  • @JoeSniderman As long as I’m not sure I don’t have a misconfiguration I’m not going to publicly announce the real names but if there’s some additional information you need, tell me. Feb 4, 2015 at 9:05

0

You must log in to answer this question.

Browse other questions tagged .