So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux and Windows.) The total number of users and machines is relatively small, somewhere in the realm of 50 machines and users mark.
- proxy-srv.example.com - 10.99.0.1
- app01-srv.example.com - 10.99.0.101
- app02-srv.example.com - 10.99.0.102
- ... etc ...
I have AD/Kerberos authentication working correctly with them against some Win2008R2 AD DCs, and things are fine. However, I would like to organize each pool/group of servers into DNS subdomains, to give users and developers a better idea of where the network starts and stops, and what machine belongs to which pool (since I will use a different subnet for each.)
What I'd like to see is something like this:
- proxy-srv.pool01.example.com = 10.99.1.1
- app01-srv.pool01.example.com = 10.99.1.101
- app02-srv.pool01.example.com = 10.99.1.102
- proxy-srv.pool02.example.com = 10.99.2.1
- app01-srv.pool02.example.com = 10.99.2.101
- app02-srv.pool02.example.com = 10.99.2.102
This, of course, causes problems with AD/Kerberos - especially with SSO/GSSAPI authentication - since the AD DC is set up to handle "example.com" and not "poolXX.example.com". Kerberos wants a single realm, and does not automatically delegate to subdomains, certificates work the same way (a wildcard cert for x.example.com will not work for subdomains (x.x.example.com) etc.
So my question is, what is the simplest way to overcome this?
- RO Child Domains Controllers for each lab for poolxx.example.com (not ideal, it adds complexity and I don't want yet another Win DC using up resources on my vSphere hosts)
- Adding of realms to Kerberos and dns SRV alias for each subdomain, each an alias to the main example.com AD DC. (Would this even work?)
- Use of sites/subnets in AD for each pool of servers?
I need some direction, it seems like I have been going in circles on this one. Any help or comments are appreciated.