README.rst

=================
Designate formula
=================

Designate provides DNSaaS services for OpenStack.

Sample pillars
==============

For Designate with BIND9 local backend:

.. code:: yaml

    designate:
      server:
        enabled: true
        region: RegionOne
        domain_id: 5186883b-91fb-4891-bd49-e6769234a8fc
        version: ocata
        backend:
          bind9:
            rndc_key: 4pc+X4PDqb2q+5o72dISm72LM1Ds9X2EYZjqg+nmsS7FhdTwzFFY8l/iEDmHxnyjkA33EQC8H+z0fLLBunoitw==
            rndc_algorithm: hmac-sha512
        api:
          base_uri: 'http://127.0.0.1:9001'
          quotas_verify_project_id: False
        admin_api:
          enabled: true
          enabled_extensions_admin: quotas
        bind:
          api:
            address: 127.0.0.1
        concurrency:
          lock_path: '/var/lib/designate'
        database:
          engine: mysql
          host: 127.0.0.1
          port: 3306
          name:
            main_database: designate
            pool_manager: designate_pool_manager
          user: designate
          password: passw0rd
        identity:
          engine: keystone
          host: 127.0.0.1
          port: 35357
          tenant: service
          user: designate
          password: passw0rd
        mdns:
          address: 0.0.0.0
          port: 5354
        message_queue:
          engine: rabbitmq
          members:
          - host: 127.0.0.1
          user: openstack
          password: password
          virtual_host: '/openstack'
        pools:
          default:
            description: 'default pool'
            attributes:
              service_tier: GOLD
            ns_records:
              - hostname: 'ns1.example.org.'
                priority: 10
            nameservers:
              - host: 127.0.0.1
                port: 53
            targets:
              default_target:
                type: bind9
                description: 'default target'
                masters:
                  - host: 127.0.0.1
                    port: 5354
                options:
                  host: 127.0.0.1
                  port: 53
                  rndc_host: 127.0.0.1
                  rndc_port: 953
                  rndc_key_file: /etc/designate/rndc.key
        quota:
          zones: 40
      worker:
        enabled: true
.. note::
   *domain_id* parameter is UUID of DNS zone managed by designate-sink service. This zone will
   be populated by A records for fixed and floating ip addresses of spawned VMs. After designate
   is deployed and zone is created, this parameter should be updated accordingly to UUID of
   newly created zone. Then designate state should be reapplied.

.. note::
   *server:api:base_uri* allows to set URL which is returned in designate-api responses, it is
   useful in cases when, designate-api is deployed under proxy server. If not overriden in reclass,
   it defaults to http://*server:bind:api:address*:9001/.

.. note::
   *server:mdns:address* and *server:mdns:port* options allow to change MDNS listening address and
   port. Changes to server:pools:*:targets will be also required if the MDNS's address and port are
   being used there.

.. note::
   *worker:enabled* sets worker role and installs designate-worker and designate-producer packages
   which services will push changes to backend DNS servers.
   *pool_manager:enabled* should be a default role for older releases of OpenStack, older than
   Newton in which designate-worker and designate-producer were represented.
   In releases starting from Newton, only Designate pool manager service still allows live syncs
   with Power DNS server for now.

.. note::
   *server:quota:zones* allows to set default value for zones quota for all projects and users.
   In case with Designate tempest plugin (0.2.0) zones quota should be increased to 40, so all
   tests can pass.

.. note::
   *server:api:quotas_verify_project_id* allows to enable project id verification when setting quotas
   for project, when Designate will ask Keystone if the project id is valid

Pools pillar for BIND9 master and multiple slaves setup:

.. code:: yaml

    pools:
      default:
        description: 'default pool'
        attributes:
          service_tier: GOLD
        ns_records:
          - hostname: 'ns1.example.org.'
            priority: 10
        nameservers:
          - host: 192.168.0.1
            port: 53
          - host: 192.168.0.2
            port: 53
          - host: 192.168.0.3
            port: 53
        targets:
          default_target:
            type: bind9
            description: 'default target'
            masters:
              - host: 192.168.0.4
                port: 5354
            options:
              host: 192.168.0.4
              port: 53
              rndc_host: 192.168.0.4
              rndc_port: 953
              rndc_key_file: /etc/designate/rndc.key

Enhanced logging with logging.conf
----------------------------------

By default logging.conf is disabled.

That is possible to enable per-binary logging.conf with new variables:
  * openstack_log_appender - set it to true to enable log_config_append for all OpenStack services;
  * openstack_fluentd_handler_enabled - set to true to enable FluentHandler for all Openstack services.

Only WatchedFileHandler and FluentHandler are available.

Also it is possible to configure this with pillar:

.. code-block:: yaml

  designate:
    server:
      logging:
        log_appender: true
        log_handlers:
          watchedfile:
            enabled: true
          fluentd:
            enabled: true

Usage
=====

Create server

.. code:: bash

    designate server-create --name ns.example.com.

Create domain

.. code:: bash

    designate domain-create --name example.com. --email mail@example.com

Create record

.. code:: bash

    designate record-create example.com. --name test.example.com. --type A --data 10.2.14.15

Test it

.. code:: bash

    dig @127.0.0.1 test.example.com.

Enable x509 and ssl communication between Designate and Galera cluster.
---------------------
By default communication between Designate and Galera is unsecure.

designate:
  server:
    database:
      x509:
        enabled: True

You able to set custom certificates in pillar:

designate:
  server:
    database:
      x509:
        cacert: (certificate content)
        cert: (certificate content)
        key: (certificate content)

You can read more about it here:
    https://docs.openstack.org/security-guide/databases/database-access-control.html

Enable x509 and ssl communication between Designate and Rabbitmq.
---------------------
By default communication between Designate and Rabbitmq is unsecure.

.. code-block:: yaml

designate:
  server:
    message_queue:
      x509:
        enabled: True

You able to set custom certificates in pillar:

.. code-block:: yaml

designate:
  server:
    message_queue:
      x509:
        cacert: (certificate content)
        cert: (certificate content)
        key: (certificate content)

You can read more about it here:
    https://docs.openstack.org/security-guide/messaging/security.html

Using designate client to create zones and install client packages
-------------------------------------------------------------------

designate:
  client:
    enabled: true
    resources:
      v2:
        enabled: true
        cloud_name: admin_identity
        zones:
          test_zone:
            name: test.zone.
            email: admin@test.zone

Change default options using configmap template settings
========================================================

.. code-block:: yaml

    designate:
      server:
        configmap:
          DEFAULT:
            default_soa_refresh_min: 3500
            default_soa_refresh_max: 3600
            default_soa_minimum: 3600
          'network_api:neutron':
            admin_username: admin
            admin_password: password
            admin_tenant_name: tenant1

Change default service policy configuration
===========================================

.. code-block:: yaml

    designate:
      server:
        policy:
          admin: 'role:admin'
          primary_zone: 'target.zone_type:PRIMARY'
          # Add key without value to remove line from policy.json
          get_quotas:

Upgrades
========

Each openstack formula provide set of phases (logical bloks) that will help to
build flexible upgrade orchestration logic for particular components. The list
of phases might and theirs descriptions are listed in table below:

+-------------------------------+------------------------------------------------------+
| State                         | Description                                          |
+===============================+======================================================+
| <app>.upgrade.service_running | Ensure that all services for particular application  |
|                               | are enabled for autostart and running                |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.service_stopped | Ensure that all services for particular application  |
|                               | disabled for autostart and dead                      |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.pkgs_latest     | Ensure that packages used by particular application  |
|                               | are installed to latest available version.           |
|                               | This will not upgrade data plane packages like qemu  |
|                               | and openvswitch as usually minimal required version  |
|                               | in openstack services is really old. The data plane  |
|                               | packages should be upgraded separately by `apt-get   |
|                               | upgrade` or `apt-get dist-upgrade`                   |
|                               | Applying this state will not autostart service.      |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.render_config   | Ensure configuration is rendered actual version.     +
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.pre             | We assume this state is applied on all nodes in the  |
|                               | cloud before running upgrade.                        |
|                               | Only non destructive actions will be applied during  |
|                               | this phase. Perform service built in service check   |
|                               | like (keystone-manage doctor and nova-status upgrade)|
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.upgrade.pre     | Mostly applicable for data plane nodes. During this  |
|                               | phase resources will be gracefully removed from      |
|                               | current node if it is allowed. Services for upgraded |
|                               | application will be set to admin disabled state to   |
|                               | make sure node will not participate in resources     |
|                               | scheduling. For example on gtw nodes this will set   |
|                               | all agents to admin disable state and will move all  |
|                               | routers to other agents.                             |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.upgrade         | This state will basically upgrade application on     |
|                               | particular target. Stop services, render             |
|                               | configuration, install new packages, run offline     |
|                               | dbsync (for ctl), start services. Data plane should  |
|                               | not be affected, only OpenStack python services.     |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.upgrade.post    | Add services back to scheduling.                     |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.post            | This phase should be launched only when upgrade of   |
|                               | the cloud is completed. Cleanup temporary files,     |
|                               | perform other post upgrade tasks.                    |
+-------------------------------+------------------------------------------------------+
| <app>.upgrade.verify          | Here we will do basic health checks (API CRUD        |
|                               | operations, verify do not have dead network          |
|                               | agents/compute services)                             |
+-------------------------------+------------------------------------------------------+


Upgrade pillar example:

.. code-block:: yaml

designate:
  upgrade:
    enabled: true
    old_release: pike
    new_release: queens
    verify:
      zone:
        enabled: true
        name: upgradetest.com.

.. note::
   During upgrade zone creation testing is disabled by default,
   because conditions for zone successfull creation, are very specific to each environment.
   When enabling zone testing, allowed tlds in Designate should be considered.
   More details about TLDS - https://docs.openstack.org/designate/pike/admin/tlds.html