[Neutron] [Designate] Private / Internal DNS Zones with custom records for i.e. service discovery

Christian Rohmann christian.rohmann at inovex.de
Thu Mar 18 09:46:59 UTC 2021


Hey Openstack-Discuss,

apart from the standardized and auto-created records for ports / 
floating-ips and instances 
(https://docs.openstack.org/neutron/latest/admin/config-dns-int.html) - 
is there any way to allow users to add their own records which then only 
resolve internally?

The Neutron API (https://docs.openstack.org/api-ref/network/v2/#id52) 
seems to be all about the resources it manages, so no additional or 
custom records there. Looking at the Designate API 
https://docs.openstack.org/api-ref/dns/?expanded=create-zone-detail#create-zone 
is does not seem to be an option to mark a zone as "internal" or 
"private". But maybe there is another way to add records to the internal 
zone?


I am thinking of an only internally resolvable / valid DNS zone carrying 
records for i.e. service discovery / cluster forming.
There are more and more tools just looking up a DNS records to find 
cluster members ...

* ElasticSearch: 
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-discovery-hosts-providers.html#settings-based-hosts-provider
* Hazelcast: 
https://github.com/hazelcast/hazelcast-kubernetes#understanding-discovery-modes
* HiveMQ: 
https://github.com/hivemq/hivemq-dns-cluster-discovery-extension/blob/master/README.adoc#configuration
* RabbitMQ: 
https://www.rabbitmq.com/cluster-formation.html#peer-discovery-dns
[...]

and with Kubernetes and the headless service concept there are more 
tools (ab)using DNS for this every week.
So having internal dns zones which only resolve within the project would 
be really helpful.


The hyperscalers call this feature

* AWS "Private hosted zones" 
(https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) 

* Azure "Private DNS" 
(https://medium.com/azure-architects/exploring-azure-private-dns-be65de08f780)
* GCP "Private zone" 
(https://cloud.google.com/blog/products/networking/introducing-private-dns-zones-resolve-to-keep-internal-networks-concealed)
* Alibaba Cloud "DNS PrivateZone" 
(https://www.alibabacloud.com/product/private-zone)


Regards


Christian




More information about the openstack-discuss mailing list