Skip to content

Commit 0db4756

Browse files
wmudgewmudge
authored
Add FreeIPA DNS for ECS role (#257)
Signed-off-by: Webster Mudge <[email protected]>
1 parent 13eb364 commit 0db4756

File tree

11 files changed

+911
-0
lines changed

11 files changed

+911
-0
lines changed

‎roles/freeipa_server_ecs/README.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# freeipa_server_ecs
2+
3+
Configure DNS zones and wildcard records for Cloudera ECS.
4+
5+
This role configures DNS zones and wildcard records within a **FreeIPA** server, which is a key step for Cloudera on Premise **Embedded Container Service (ECS)**. It simplifies the process of setting up name resolution for applications and services within a specific domain by automatically creating a DNS zone and populating it with wildcard DNS records pointing to a single IP address.
6+
7+
The role will:
8+
- Authenticate to a FreeIPA server using the provided administrative credentials.
9+
- Create a new DNS zone based on the `ipaserver_domain` and the `zone_name` defined in the `freeipa_dns_records` list.
10+
- Add wildcard DNS records (`*` records) to the specified zone.
11+
- Point these wildcard records to the target IP address defined in `freeipa_dns_records_address`.
12+
- Optionally, skip a check for overlapping DNS zones if `dnszone_skip_overlap_check` is set to `true`.
13+
- Execute all commands via the FreeIPA API, either on a client or server context.
14+
15+
## Requirements
16+
17+
- A running and accessible **FreeIPA server**.
18+
- The `ipaadmin_principal` must have permissions to create DNS zones and records within the FreeIPA environment.
19+
- Network connectivity from the Ansible controller (or the `ipaapi_context` host) to the FreeIPA server.
20+
21+
## Dependencies
22+
23+
None.
24+
25+
## Parameters
26+
27+
| Variable | Type | Required | Default | Description |
28+
| --- | --- | --- | --- | --- |
29+
| `ipaadmin_password` | `str` | `True` | | **FreeIPA** administrative password for authentication. |
30+
| `ipaadmin_principal` | `str` | `False` | `admin` | **FreeIPA** administrative principal (user) for authentication. |
31+
| `ipaserver_host` | `str` | `False` | `inventory_hostname` | Hostname or IP address of the **FreeIPA** server to connect to. Defaults to the current host. |
32+
| `ipaserver_domain` | `str` | `True` | | The **FreeIPA** domain under which the DNS zone will be created (e.g., `example.internal`). |
33+
| `freeipa_dns_records` | `list` of `dict` | `False` | `[{'zone_name': 'apps.{{ ipaserver_domain }}', 'record_name': '*', 'record_type': 'A'}, {'zone_name': '{{ ipaserver_domain }}', 'record_name': '*', 'record_type': 'A'}]` | A list of DNS records to create within the specified **FreeIPA** domain. Each dictionary defines a record with its `zone_name`, `record_name`, and `record_type`. Defaults to creating two wildcard A records. |
34+
| `freeipa_dns_records_address` | `str` | `True` | | The target IP address for the DNS records defined in `freeipa_dns_records`. All records will point to this address. |
35+
| `dnszone_skip_overlap_check` | `bool` | `False` | `false` | A flag to skip the overlap check when creating DNS zones, which can be useful in specific configurations but should be used with caution. |
36+
| `ipaapi_context` | `str` | `False` | - | The **FreeIPA** role of the host where the DNS Zone creation command will be executed. Choices are `client` or `server`. |
37+
38+
## Example Playbook
39+
40+
```yaml
41+
- hosts: ipaserver_host
42+
tasks:
43+
- name: Configure FreeIPA DNS for ECS with default wildcard records
44+
ansible.builtin.import_role:
45+
name: cloudera.exe.freeipa_server_ecs
46+
vars:
47+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault for this
48+
ipaserver_domain: "example.internal"
49+
freeipa_dns_records_address: "10.0.0.100"
50+
# The role will automatically create '*' records for 'apps.example.internal' and 'example.internal'
51+
52+
- name: Configure a single custom DNS record for ECS
53+
ansible.builtin.import_role:
54+
name: cloudera.exe.freeipa_server_ecs
55+
vars:
56+
ipaadmin_password: "MySuperSecretAdminPassword"
57+
ipaserver_domain: "example.internal"
58+
freeipa_dns_records_address: "10.0.0.200"
59+
freeipa_dns_records:
60+
- zone_name: "custom.{{ ipaserver_domain }}"
61+
record_name: "customapp"
62+
record_type: "A"
63+
dnszone_skip_overlap_check: true
64+
ipaapi_context: "client"
65+
```
66+
67+
## License
68+
69+
```
70+
Copyright 2025 Cloudera, Inc.
71+
72+
Licensed under the Apache License, Version 2.0 (the "License");
73+
you may not use this file except in compliance with the License.
74+
You may obtain a copy of the License at
75+
76+
https://www.apache.org/licenses/LICENSE-2.0
77+
78+
Unless required by applicable law or agreed to in writing, software
79+
distributed under the License is distributed on an "AS IS" BASIS,
80+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
81+
See the License for the specific language governing permissions and
82+
limitations under the License.
83+
```

‎roles/freeipa_server_ecs/defaults/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
ipaadmin_principal: admin
17+
ipaadmin_password: "{{ undef(hint='Please define the FreeIPA adminstrator principal password') }}"
18+
ipaserver_domain: "{{ undef(hint='Please define the FreeIPA server domain') }}"
19+
ipaserver_host: "{{ inventory_hostname }}"
20+
# ipaapi_context:
21+
22+
dnszone_skip_overlap_check: false
23+
24+
freeipa_dns_records:
25+
- zone_name: "apps.{{ ipaserver_domain }}"
26+
record_name: "*"
27+
record_type: "A"
28+
29+
freeipa_dns_records_address: "{{ undef(hint='Please define the FreeIPA DNS records target IP address for ECS') }}"

‎roles/freeipa_server_ecs/meta/argument_specs.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
argument_specs:
17+
main:
18+
short_description: Configure DNS zones and wildcard records for ECS
19+
description:
20+
- Ensures that DNS zones and wildcard records are set up in FreeIPA for ECS.
21+
- Creates a specified DNS zone and adds wildcard DNS records.
22+
author: Cloudera Labs
23+
version_added: 3.0.0
24+
options:
25+
ipaadmin_password:
26+
description: FreeIPA admin password used for authentication.
27+
required: true
28+
ipaadmin_principal:
29+
description: FreeIPA admin principal used for authentication.
30+
default: admin
31+
ipaserver_host:
32+
description: Hostname or IP address of the FreeIPA server.
33+
default: C(inventory_hostname)
34+
ipaserver_domain:
35+
description: The FreeIPA domain to use for creating the DNS zone and records.
36+
required: true
37+
freeipa_dns_records:
38+
description: DNS records to create within the FreeIPA domain, i.e. DNS zone.
39+
type: list
40+
elements: dict
41+
options:
42+
zone_name:
43+
description: Name of the DNS zone to create the record in.
44+
required: true
45+
record_name:
46+
description: Name of the DNS record (use C(*) for a wildcard record).
47+
required: true
48+
record_type:
49+
description: Type of the DNS record (e.g., A, AAAA).
50+
required: true
51+
default:
52+
- zone_name: "apps.C(ipaserver_domain)"
53+
record_name: "*"
54+
record_type: "A"
55+
- zone_name: "C(ipaserver_domain)"
56+
record_name: "*"
57+
record_type: "A"
58+
freeipa_dns_records_address:
59+
description: DNS records target IP address for the records defined in O(freeipa_dns_records).
60+
type: str
61+
required: true
62+
dnszone_skip_overlap_check:
63+
description: Skip overlap check when creating DNS zones.
64+
type: bool
65+
required: false
66+
default: false
67+
ipaapi_context:
68+
description: The FreeIPA role of the host where the DNS Zone creation will execute.
69+
type: str
70+
required: false
71+
choices:
72+
- client
73+
- server

‎roles/freeipa_server_ecs/molecule/default/converge.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Converge
17+
hosts: all
18+
gather_facts: true
19+
tasks:
20+
- name: Provision ECS DNS entries
21+
ansible.builtin.import_role:
22+
name: cloudera.exe.freeipa_server_ecs
23+
vars:
24+
freeipa_dns_records_address: "{{ ansible_default_ipv4.address }}"

0 commit comments

Comments
 (0)