Portal:Cloud VPS/Admin/Designate

From Wikitech
Jump to navigation Jump to search

This page contains information on how to operate Desginate, which is a key component in our DNS setup.

DNS servers

  • cloud-recursor0.wikimedia.org == cloudservices1003.wikimedia.org
  • cloud-recursor1.wikimedia.org == cloudservices1004.wikimedia.org
  • cloud-ns0.wikimedia.org == cloudservices1003.wikimedia.org
  • cloud-ns1.wikimedia.org == cloudservices1004.wikimedia.org

Wiki Replica DNS

See Portal:Data_Services/Admin/Wiki_Replica_DNS


This script actually generates a lua script which is read by pdns-recursor. This is not technical anything related to Designate, but it is relevant to Cloud VPS DNS lookups. The script hooks two lua resolver hooks:

Maps public IPs to private IPs so that a lookup that results in a floating IP instead returns the private IP of the instance that it is attached to.
Injects additional DNS results that are only visible via the recursor. Currently used to provide DNS responses for:
  • puppet.
  • tools-db.tools.eqiad.wmflabs.
  • tools-redis.eqiad.wmflabs.
  • tools-redis.tools.eqiad.wmflabs.

The script runs via cron every 30 minutes on each pdns-recursor host.


Labs has a block of public IPs:

Unfortunately are production IPs

Therefore production can't delegate the whole of the 155.80.208.in-addr.arpa. zone to labs NS servers for us to automate reverse DNS records from

Our workaround is RFC 2317-style delegation: We have a zone called 128- (living under the wmflabsdotorg tenant IIRC) that production CNAMEs all the usual in-addr records for labs into, and delegates the zone to labs nameservers.

We have a script called dns-floating-ip-updater that sets up instance-{instancename}.{project}.wmflabs.org records (assuming {project}.wmflabs.org exists as a domain, if not they don't get the feature) and the reverse DNS record for that, then also sets up the reverse DNS for all manually curated A records.

What happens when someone makes a reverse DNS lookup, for let's say

  • It gets turned into a PTR lookup on as normal
  • Prod NS servers control the 155.80.208.in-addr.arpa. zone - if you open the file for that in the operations/dns.git repository ('templates' directory), you'll see the first 128 addresses are reserved for prod (some in use, some not)
  • So under 208.80.155, number 131 is IN CNAME 131.128-25 i.e. 131.128-
  • 128- is delegated from prod to labs NS, i.e. designate.
  • So the full lookup becomes 131.128- and is sent to the labs NS server
  • This script ensures that designate knows how to answer that query, by populating all the records.

For example:

$ host bastion.wmflabs.org
bastion.wmflabs.org has address # this is answered by the labs nameservers (designate) as they control wmflabs.org, under the wmflabsdotorg tenant
$ host is an alias for 129.128- # this is the production nameservers delegating the query to labs designate
129.128- domain name pointer bastion.wmflabs.org. # this is from the labs nameservers (designate) and is because bastion.wmflabs.org points to that IP
129.128- domain name pointer instance-bastion-01.bastion.wmflabs.org. # this comes from the labs nameservers (designate) and is used to indicate which instance a given IP points to, partially in case it lacks other names, but it's helpful regardless. (think what happens if we didn't have this entry but you wanted to go look up the instance on the project's instance list knowing only it's IP - and that's assuming you know which project to look under)
129.128- domain name pointer primary.bastion.wmflabs.org. # this is from the labs nameservers (designate) and is because primary.bastion.wmflabs.org points to that IP
$ host instance-bastion-01.bastion.wmflabs.org
instance-bastion-01.bastion.wmflabs.org has address # this comes from the labs nameservers (designate) - wouldn't make sense to provide the PTR above without this

We will need to do some work on our script to be able to add new domains or public IP ranges (e.g. for other datacentres, to introduce IPv6, or to simply get more addresses).

Announcement post: https://www.mail-archive.com/labs-l@lists.wikimedia.org/msg04516.html


Some special hosts are defined in profile::openstack::main::pdns::recursor_aliaser_extra_records:

  • tools-db.tools.eqiad.wmflabs
  • tools-redis.tools.eqiad.wmflabs
  • tools-redis.eqiad.wmflabs
  • puppet

Administrative scripts

See CloudVPS maintenance, DNS admin scripts.