maas dns role for configuring maas dns domains and records by akraitman · Pull Request #778 · ceph/ceph-cm-ansible

akraitman · 2025-03-25T09:14:11Z

No description provided.

djgalloway · 2025-03-25T15:57:38Z

Please add a README explaining all of the variables and what the secrets variables should look like. Like this: https://github.com/ceph/ceph-cm-ansible/blob/main/roles/nameserver/README.rst

djgalloway · 2025-03-25T20:08:36Z

If you look at the README in the Web UI, it does not get rendered as expected. Maybe it's .md instead of .rst`?

roles/maas_nameserver/tasks/main.yml

roles/maas_nameserver/README.rst

akraitman · 2025-03-26T08:38:06Z

If you look at the README in the Web UI, it does not get rendered as expected. Maybe it's .md instead of .rst`?

https://github.com/ceph/ceph-cm-ansible/tree/wip-maas-dns/roles/maas_nameserver

djgalloway · 2025-03-31T18:02:52Z

roles/maas_nameserver/README.md

+The `maas_nameserver` role depends on the `secrets` role to load encrypted MAAS API credentials. The secrets file is expected at `{{ secrets_path }}/maas.yml`, where `secrets_path` defaults to `/etc/ansible/secrets`.
+
+### Example Secrets File
+Create and encrypt the file (e.g., `/etc/ansible/secrets/maas.yml`):


This should be {{ secrets_path }} with no mention of /etc/ansible.

djgalloway · 2025-03-31T18:04:45Z

How feasible is it to test this against our existing ansible inventories?

akraitman · 2025-04-01T13:08:24Z

How feasible is it to test this against our existing ansible inventories?

I have tested and verified it against a similar inventory like we have in sepia

roles/maas_nameserver/tasks/main.yml

roles/maas_nameserver/defaults/main.yml

roles/maas_nameserver/tasks/main.yml

djgalloway · 2025-04-21T14:29:47Z

roles/maas_nameserver/vars/main.yml

dns_domains should be empty in this repo and overridden in the ansible inventory.

Fixed and updated the changes in the readme file

djgalloway · 2025-04-23T13:06:19Z

Ping me and @dmick when this is ready again for review please

djgalloway · 2025-04-23T16:18:18Z

roles/maas_nameserver/vars/main.yml

Is this necessary?

I removed it for now

dmick

Stopped midway through when I got to something I could not begin to explain. We need to have a live session about this.

dmick · 2025-05-02T19:26:30Z

roles/maas_nameserver/README.md

+
+## Dependencies
+
+- **Secrets File**: A `maas.yml` file at `{{ secrets_path }}/maas.yml` provides MAAS API credentials (e.g., `maas_api_key`, `maas_api_url`). No separate secrets role is required; credentials are loaded via `include_vars`.


I assume it literally needs to contain maas_api_key and maas_api_url; those aren't 'examples', but: why is the api_url a secret? and can you show a sample {{ secrets_path }}/maas.yml file just to be clear?

I agree that the url it's not a secret but I think it's a good practice to place the api_key, profile and url in the same place since we need all three to communicate with the maas api for maas.yml there is already an example in line 64

dmick · 2025-05-02T19:27:21Z

roles/maas_nameserver/README.md

+
+## Usage
+
+1. **Place the Role**


"Place" isn't the verb I'd choose, but I'd just remove this whole step; it's obvious that to use code you have to have it in place

dmick · 2025-05-02T19:30:08Z

roles/maas_nameserver/README.md

+
+   ```ini
+   [maas]
+   maas.internal.ceph.ibm.com ip=10.11.120.237


Since I now know there are multiple hosts involved in the maas installation, it seems like we need to specify which host is getting the DNS update. The hosts Fernando talks about are "db", "region+rack", and "secondary rack". How are these specified in inventory, and which one should execute this role?

I don't know of other hosts I am executing the role against the host running the maas api

dmick · 2025-05-02T19:30:50Z

roles/maas_nameserver/README.md

+   [maas]
+   maas.internal.ceph.ibm.com ip=10.11.120.237
+
+   [snipeit]


is this a target host in some way? This role doesn't involve snipe directly, does it?

No, it's just an example

dmick · 2025-05-02T19:31:16Z

roles/maas_nameserver/README.md

+   [snipeit]
+   snipe-it.internal.ceph.ibm.com ip=10.60.100.11
+
+   [machine]


What are the contents of the machine group supposed to be?

It's just an example, it doesn't mean anything, I could call it anything I just chosen some group name

dmick · 2025-05-02T20:17:33Z

roles/maas_nameserver/defaults/main.yml

+  - "maas"
+
+# List of target hosts for DNS records, excluding the 'maas' group by default.
+# Can be overridden in secrets/maas.yml (e.g., target_hosts: ['host1.example.com', 'host2.example.com'])


not a secret

dmick · 2025-05-02T20:33:20Z

roles/maas_nameserver/tasks/main.yml

+  ansible.builtin.command: "maas login {{ maas_profile }} {{ maas_api_url }} {{ maas_api_key }}"
+  register: maas_login
+  changed_when: maas_login.rc == 0
+  failed_when: maas_login.rc != 0 and maas_login.stderr != "Profile already exists"


When does login say "Profile already exists"? It always already exists for you to be able to login, doesn't it?

dmick · 2025-05-02T20:35:29Z

roles/maas_nameserver/tasks/main.yml

+  ansible.builtin.set_fact:
+    dns_records: []
+
+# Define target hosts list for DNS records, excluding the 'maas' group.


if the group to be excluded is in a variable, the comment should refer to the variable

dmick · 2025-05-02T22:31:18Z

roles/maas_nameserver/tasks/main.yml

+
+# After population, target_hosts will contain all hosts from inventory groups except 'maas', e.g.,
+# ['machine001.internal.example.com', 'snipe.internal.example.com', 'vm-14.example.com'].
+# This can be overridden in secrets/maas.yml (e.g., target_hosts: ['host1.example.com', 'host2.example.com'])


not a secret

dmick · 2025-05-03T00:09:44Z

roles/maas_nameserver/tasks/main.yml

+- name: Build DNS records for all interfaces
+  ansible.builtin.set_fact:
+    dns_records: "{{ dns_records + [{'name': item[0].split('.')[0], 'ip': interface_ip, 'type': 'A', 'domain': item[1].value}] }}"
+  loop: "{{ (target_hosts | default([])) | product(dns_domains | dict2items) | list }}"


I don't have the faintest idea what's going on here. It looks as though this will make a list of two-element combinations of every item in target_hosts and every item in dns_domains. How is that remotely useful?

I think at this point I'm going to have to stop reviewing until we can talk. I'll save this review this far, but I'm not done.

djgalloway · 2025-07-15T16:22:15Z

I think you want to squash your commits. Also, effort should be made to keep the actual commit message (the top line) as short as possible. e.g., maas_nameserver: Create role. All the bullet points under that are fine.

- Configures DNS entries for hosts (e.g., main interfaces, IPMI interfaces) using `dns_domains` and inventory variables (`ip`, `ipmi`). - Dynamically sets `maas_cluster_instance.host` via `maas_api_url` in `defaults/main.yml`, with credentials (`customer_key`, `token_key`, `token_secret`) loaded from a secrets file (`secrets/maas.yml`). - Filters inventory to process only hosts with `ip` or `ipmi` variables, excluding groups like `all` and `ungrouped`. - Cleans up unwanted DNS records and domains not in `dns_domains` or `excluded_domains`, skipping default MAAS domains. - Skips NS record creation due to module limitations, with instructions for manual creation via MAAS CLI/UI. - Includes comprehensive `README.md` with: - Inventory example with `mac`, `ip`, `ipmi`, and `bmc` attributes (e.g., `server01.example.com mac=00:1a:2b:3c:4d:5e ip=192.168.1.11 ipmi=192.168.2.11 bmc=00:1a:2b:3c:4d:5f`). - Setup instructions for inventory, secrets, and variables. - Troubleshooting for common issues (e.g., network errors, missing `dns_domains`). - Performance tips (e.g., fact caching). - Ensures idempotency and supports large inventories.

akraitman requested a review from djgalloway March 25, 2025 09:14

akraitman force-pushed the wip-maas-dns branch 3 times, most recently from 9a88e24 to 5fed40f Compare March 25, 2025 16:28

djgalloway requested changes Mar 25, 2025

View reviewed changes

roles/maas_nameserver/tasks/main.yml Outdated Show resolved Hide resolved

roles/maas_nameserver/tasks/main.yml Outdated Show resolved Hide resolved

roles/maas_nameserver/README.rst Outdated Show resolved Hide resolved

roles/maas_nameserver/README.rst Outdated Show resolved Hide resolved

akraitman force-pushed the wip-maas-dns branch 3 times, most recently from 1eb5687 to 92b9df3 Compare March 26, 2025 08:33

akraitman force-pushed the wip-maas-dns branch 4 times, most recently from 152f202 to b375ae2 Compare March 27, 2025 11:56

djgalloway reviewed Mar 31, 2025

View reviewed changes

akraitman force-pushed the wip-maas-dns branch from b375ae2 to 5df8c9b Compare April 1, 2025 12:58

akraitman force-pushed the wip-maas-dns branch 3 times, most recently from 94a08ae to 9a6a76d Compare April 3, 2025 10:41

djgalloway reviewed Apr 11, 2025

View reviewed changes

roles/maas_nameserver/tasks/main.yml Outdated Show resolved Hide resolved

djgalloway requested a review from dmick April 14, 2025 16:44

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from 6c1e94d to 815e3e5 Compare April 21, 2025 12:03

djgalloway reviewed Apr 21, 2025

View reviewed changes

roles/maas_nameserver/defaults/main.yml Outdated Show resolved Hide resolved

djgalloway reviewed Apr 21, 2025

View reviewed changes

roles/maas_nameserver/tasks/main.yml Outdated Show resolved Hide resolved

djgalloway reviewed Apr 21, 2025

View reviewed changes

akraitman force-pushed the wip-maas-dns branch from 815e3e5 to 59ed665 Compare April 21, 2025 14:51

akraitman force-pushed the wip-maas-dns branch 3 times, most recently from 51d3b98 to 6264d86 Compare April 23, 2025 08:41

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from fa552bf to 0701de9 Compare April 23, 2025 15:44

djgalloway reviewed Apr 23, 2025

View reviewed changes

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from 654665d to b346a19 Compare April 24, 2025 08:44

dmick requested changes May 3, 2025

View reviewed changes

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from 26897f8 to b42e556 Compare May 5, 2025 16:30

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from 25ca9ca to 7dfab8b Compare July 14, 2025 16:24

akraitman requested review from djgalloway and dmick July 14, 2025 16:28

akraitman force-pushed the wip-maas-dns branch 2 times, most recently from ad35b54 to e1ba19c Compare July 14, 2025 18:10

akraitman force-pushed the wip-maas-dns branch from e1ba19c to d0780e2 Compare July 16, 2025 13:54


		## Dependencies

		- Secrets File: A `maas.yml` file at `{{ secrets_path }}/maas.yml` provides MAAS API credentials (e.g., `maas_api_key`, `maas_api_url`). No separate secrets role is required; credentials are loaded via `include_vars`.

Comments

Conversation

akraitman commented Mar 25, 2025

Uh oh!

djgalloway commented Mar 25, 2025

Uh oh!

djgalloway commented Mar 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akraitman commented Mar 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djgalloway commented Mar 31, 2025

Uh oh!

akraitman commented Apr 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djgalloway commented Apr 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmick left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akraitman May 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

djgalloway commented Jul 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

akraitman commented Apr 1, 2025 •

edited

Loading

akraitman May 4, 2025 •

edited

Loading