使用 OpenStack Designate 构建 DNS 即服务

Designate 是一个多租户 DNS 即服务，包括用于域和记录管理的 REST API、用于与 Neutron 集成的框架，以及对 Bind9 的集成支持。

您可能需要考虑 DNSaaS，原因如下：

• 用于管理区域和记录的清晰 REST API
• 自动生成记录（通过 OpenStack 集成）
• 支持多个权威名称服务器
• 托管多个项目/组织

本文介绍如何在 CentOS 或 Red Hat Enterprise Linux 7 (RHEL 7) 上手动安装和配置 Designate 服务的最新版本，但您可以在其他发行版上使用相同的配置。

在 OpenStack 上安装 Designate

我为 bind 和 Designate 提供了 Ansible 角色，并在我的 GitHub 存储库 中演示了该设置。

此设置假定 bind 服务是外部的（即使您可以将 bind 本地安装在 OpenStack 控制器节点上）。

1. 安装 Designate 的软件包和 bind (在 OpenStack 控制器上)
   

   # yum install openstack-designate-* bind bind-utils -y

2. 创建 Designate 数据库和用户
   

   MariaDB [(none)]> CREATE DATABASE designate CHARACTER SET utf8 COLLATE utf8_general_ci;
          
   MariaDB [(none)]> GRANT ALL PRIVILEGES ON designate.* TO \
   'designate'@'localhost' IDENTIFIED BY 'rhlab123';
   
   MariaDB [(none)]> GRANT ALL PRIVILEGES ON designate.* TO 'designate'@'%' \
   IDENTIFIED BY 'rhlab123';

注意：必须在控制器端安装 Bind 软件包，以便远程名称守护进程控制 (RNDC) 正常工作。

配置 bind (DNS 服务器)

1. 生成 RNDC 文件
   

   rndc-confgen -a -k designate -c /etc/rndc.key -r /dev/urandom
   
   cat <<EOF> etcrndc.conf
   include "/etc/rndc.key";
   options {
      default-key "designate";
      default-server {{ DNS_SERVER_IP }};
      default-port 953;
   };
   EOF

2. 将以下内容添加到 named.conf 中
   

   include "/etc/rndc.key";
   controls {
           inet {{ DNS_SERVER_IP }}  allow { localhost;{{ CONTROLLER_SERVER_IP }}; } keys { "designate"; };
     };

   在 option 部分，添加

   options {
   ...
    allow-new-zones yes;
    request-ixfr no;
    listen-on port 53 { any; };
    recursion no;
    allow-query { 127.0.0.1; {{ CONTROLLER_SERVER_IP }}; };
   };

   添加正确的权限

    chown named:named /etc/rndc.key
    chown named:named /etc/rndc.conf
    chmod 600 /etc/rndc.key
    chown -v root:named /etc/named.conf
    chmod g+w /var/named
   
   
   # systemctl restart named
   # setsebool named_write_master_zones 1

3. 将 rndc.key 和 rndc.conf 推送到 OpenStack 控制器
   

   # scp -r /etc/rndc* {{ CONTROLLER_SERVER_IP }}:/etc/

创建 OpenStack Designate 服务和端点

输入

# openstack user create --domain default --password-prompt designate
# openstack role add --project services --user designate admin
# openstack service create --name designate --description "DNS" dns

# openstack endpoint create --region RegionOne dns public http://{{ CONTROLLER_SERVER_IP }}:9001/
# openstack endpoint create --region RegionOne dns internal http://{{ CONTROLLER_SERVER_IP }}:9001/  
# openstack endpoint create --region RegionOne dns admin http://{{ CONTROLLER_SERVER_IP }}:9001/

配置 Designate 服务

1. 编辑 /etc/designate/designate.conf
   • 在 [service:api] 部分，配置 auth_strategy
     

     [service:api]
     listen = 0.0.0.0:9001
     auth_strategy = keystone
     api_base_uri = http://{{ CONTROLLER_SERVER_IP }}:9001/
     enable_api_v2 = True
     enabled_extensions_v2 = quotas, reports

   • 在 [keystone_authtoken] 部分，配置以下选项
     

     [keystone_authtoken]
     auth_type = password
     username = designate
     password = rhlab123
     project_name = service
     project_domain_name = Default
     user_domain_name = Default
     www_authenticate_uri = http://{{ CONTROLLER_SERVER_IP }}:5000/
     auth_url = http://{{ CONTROLLER_SERVER_IP }}:5000/

   • 在 [service:worker] 部分，启用 worker 模型
     

     enabled = True
     notify = True

   • 在 [storage:sqlalchemy] 部分，配置数据库访问
     

     [storage:sqlalchemy]
     connection = mysql+pymysql://designate:rhlab123@{{ CONTROLLER_SERVER_IP }}/designate

   • 填充 Designate 数据库
     

     # su -s /bin/sh -c "designate-manage database sync" designate

2. 创建 Designate 的 pools.yaml 文件（包含目标和 bind 详细信息）
   • 编辑 /etc/designate/pools.yaml
     

     - name: default
       # The name is immutable. There will be no option to change the name after
       # creation and the only way will to change it will be to delete it
       # (and all zones associated with it) and recreate it.
       description: Default Pool
     
       attributes: {}
     
       # List out the NS records for zones hosted within this pool
       # This should be a record that is created outside of designate, that
       # points to the public IP of the controller node.
       ns_records:
         - hostname: {{Controller_FQDN}}. # Thisis mDNS
           priority: 1
     
       # List out the nameservers for this pool. These are the actual BIND servers.
       # We use these to verify changes have propagated to all nameservers.
       nameservers:
         - host: {{ DNS_SERVER_IP }}
           port: 53
     
       # List out the targets for this pool. For BIND there will be one
       # entry for each BIND server, as we have to run rndc command on each server
       targets:
         - type: bind9
           description: BIND9 Server 1
     
           # List out the designate-mdns servers from which BIND servers should
           # request zone transfers (AXFRs) from.
           # This should be the IP of the controller node.
           # If you have multiple controllers you can add multiple masters
           # by running designate-mdns on them, and adding them here.
           masters:
             - host: {{ CONTROLLER_SERVER_IP }}
               port: 5354
     
           # BIND Configuration options
           options:
             host: {{ DNS_SERVER_IP }}
             port: 53
             rndc_host: {{ DNS_SERVER_IP }}
             rndc_port: 953
             rndc_key_file: /etc/rndc.key
             rndc_config_file: /etc/rndc.conf

   • 填充 Designate 的 pools
     

     su -s /bin/sh -c "designate-manage pool update" designate

3. 启动 Designate central 和 API 服务
   

   systemctl enable --now designate-central designate-api

4. 验证 Designate 的服务是否已启动
   

   # openstack dns service list
   
   +--------------+--------+-------+--------------+
   | service_name | status | stats | capabilities |
   +--------------+--------+-------+--------------+
   | central      | UP     | -     | -            |
   | api          | UP     | -     | -            |
   | mdns         | UP     | -     | -            |
   | worker       | UP     | -     | -            |
   | producer     | UP     | -     | -            |
   +--------------+--------+-------+--------------+

使用外部 DNS 配置 OpenStack Neutron

1. 为 Designate 服务配置 iptables
   

   # iptables -I INPUT -p tcp -m multiport --dports 9001 -m comment --comment "designate incoming" -j ACCEPT
          
   # iptables -I INPUT -p tcp -m multiport --dports 5354 -m comment --comment "Designate mdns incoming" -j ACCEPT
          
   # iptables -I INPUT -p tcp -m multiport --dports 53 -m comment --comment "bind incoming" -j ACCEPT
          
           
   # iptables -I INPUT -p udp -m multiport --dports 53 -m comment --comment "bind/powerdns incoming" -j ACCEPT
          
   # iptables -I INPUT -p tcp -m multiport --dports 953 -m comment --comment "rndc incoming - bind only" -j ACCEPT
          
   # service iptables save; service iptables restart
   # setsebool named_write_master_zones 1

2. 编辑 /etc/neutron/neutron.conf 的 [default] 部分
   

   external_dns_driver = designate

3. 在 /_etc/_neutron/neutron.conf 中添加 [designate] 部分
   

   [designate]
   url = http://{{ CONTROLLER_SERVER_IP }}:9001/v2  ## This end point of designate
   auth_type = password
   auth_url = http://{{ CONTROLLER_SERVER_IP }}:5000
   username = designate
   password = rhlab123
   project_name = services
   project_domain_name = Default
   user_domain_name = Default
   allow_reverse_dns_lookup = True
   ipv4_ptr_zone_prefix_size = 24
   ipv6_ptr_zone_prefix_size = 116

4. 在 neutron.conf 中编辑 dns_domain
   

   dns_domain = rhlab.dev.
   
   # systemctl restart neutron-*

5. 将 dns 添加到 /etc/neutron/plugins/ml2/ml2_conf.ini 中模块化二层 (ML2) 驱动程序的列表中
   

   extension_drivers=port_security,qos,dns

6. 在 Designate 中添加 zone
   

   # openstack zone create –email=admin@rhlab.dev rhlab.dev.

   在 zone rhlab.dev 中添加新记录

   # openstack recordset create --record '192.168.1.230' --type A rhlab.dev. Test

Designate 现在应该已安装并配置完成。