Skip to main content

Authoritative DNS (Designate & PowerDNS)

Okustera DNS-as-a-Service (DNSaaS) delivers multi-tenant, authoritative domain name resolution powered by OpenStack Designate and PowerDNS Authoritative Server (pdns4).

Tenants can register public and private authoritative DNS zones, manage standard DNS recordsets (A, AAAA, CNAME, MX, TXT, SRV, PTR, NS, CAA), automatically resolve internal VPC compute hostnames (*.opencloud.local.), and bind domains directly to Octavia Load Balancer VIPs with 1-click forward (A) and reverse (PTR) DNS synthesis.

Key Capabilities​

  • Multi-Tenant Authoritative Zones: Provision isolated PRIMARY and SECONDARY DNS zones backed by high-performance PowerDNS authoritative nameservers (ns1.opencloud.local., ns2.opencloud.local.).
  • 1-Click Octavia Load Balancer VIP Binding: Point root apex (@) or subdomain records (app, api, lb) directly to an Octavia Load Balancer Virtual IP (VIP) in a single click from either the Networking or Load Balancers console.
  • Automated Reverse DNS (PTR) Synthesis: Automatically generates and synchronizes in-addr.arpa. reverse zones and PTR records whenever binding Load Balancer VIPs or associating Neutron Floating IPs with dns_domain and dns_name.
  • Neutron Internal & External DNS Integration: Powered by Neutron's ML2 dns extension driver (extension_drivers = port_security,dns), instances launched inside tenant VPCs automatically receive internal FQDNs under opencloud.local..
  • Full Recordset Coverage: First-class validation and lifecycle management for A, AAAA, CNAME, MX, TXT, SRV, PTR, NS, and CAA recordsets with configurable TTLs (60s–86400s) and automatic SOA serial incrementing.
  • Declarative Terraform IaC: Native okustera_dns_zone and okustera_dns_recordset Terraform resources for GitOps-driven DNS management.

Architecture Overview​

Managing DNS in the Okustera Cloud Portal​

You can manage authoritative DNS zones and recordsets from two locations in the Okustera Cloud Portal:

1. Networking Console (/network $\to$ DNS Zones (Designate))​

  1. Navigate to Networking and select the DNS Zones (Designate) tab.
  2. Click Create DNS Zone and specify:
    • Zone Name (FQDN): e.g., example.com. (trailing dot is automatically normalized).
    • Administrator Email: e.g., [email protected].
    • Default TTL: e.g., 300 seconds.
    • Associated VPC (Optional): Associate the zone with a Tenant VPC for internal split-horizon reference.
  3. Select the newly created zone to inspect its auto-generated system SOA and NS recordsets, serial number, and authoritative PowerDNS endpoint.
  4. Click Add Recordset to create A, AAAA, CNAME, MX, TXT, SRV, PTR, NS, or CAA records, or click the inline Edit action on any user recordset to update its TTL or target values in place.

2. 1-Click Octavia Load Balancer VIP Binding (/octavia & /network)​

To point a domain or subdomain directly to an Octavia Load Balancer VIP:

  1. Open either Networking $\to$ DNS Zones (Designate) or Load Balancers (/octavia) $\to$ DNS & VIP Binding (Designate).
  2. Click 1-Click Bind Octavia VIP.
  3. Choose the target DNS Zone (e.g., example.com.), enter the Subdomain (@ for apex example.com. or lb for lb.example.com.), and select your active Octavia Load Balancer from the dropdown (or specify a VIP/Floating IP).
  4. Keep Automatically create Reverse DNS (PTR) record enabled and click Bind VIP.
  5. The platform atomically provisions the forward A recordset in your zone and the corresponding reverse PTR recordset in the in-addr.arpa. zone, immediately synchronizing both with PowerDNS.

Declarative Configuration via Terraform​

Manage DNS zones, application records, and Load Balancer VIP bindings declaratively using the official okustera Terraform provider:

# 1. Create an Authoritative DNS Zone
resource "okustera_dns_zone" "primary" {
  name        = "example.com."
  email       = "[email protected]"
  ttl         = 300
  description = "Production authoritative DNS zone"
}

# 2. Bind Subdomain to an Octavia Load Balancer VIP
resource "okustera_dns_recordset" "app_ingress" {
  zone_id     = okustera_dns_zone.primary.id
  name        = "app.example.com."
  type        = "A"
  ttl         = 60
  records     = [okustera_loadbalancer.web_lb.vip_address]
  description = "Production Octavia Ingress VIP"
}

# 3. Configure MX and TXT (SPF) Records
resource "okustera_dns_recordset" "mail_mx" {
  zone_id = okustera_dns_zone.primary.id
  name    = "example.com."
  type    = "MX"
  ttl     = 3600
  records = [
    "10 mail1.example.com.",
    "20 mail2.example.com."
  ]
}

Verifying DNS Resolution with dig​

Every zone in the Cloud Portal displays a copy-pasteable dig verification command targeting the authoritative PowerDNS service endpoint:

# Query forward A record resolution
dig @<POWERDNS_ENDPOINT_IP> app.example.com A +noall +answer

# Query SOA and authoritative NS records
dig @<POWERDNS_ENDPOINT_IP> example.com SOA +noall +answer

# Query automatic Reverse DNS (PTR) record for a Load Balancer VIP
dig @<POWERDNS_ENDPOINT_IP> -x 198.51.100.50 +noall +answer

REST API Reference​

DNS Zones​

  • GET /api/v1/networking/dns/zones — List all authoritative DNS zones in the current tenant project.
  • POST /api/v1/networking/dns/zones — Create a new authoritative DNS zone (PRIMARY or SECONDARY) and initialize SOA/NS records in PowerDNS.
  • GET /api/v1/networking/dns/zones/{zone_id} — Retrieve zone details, serial number, nameservers, and recordsets.
  • PATCH /api/v1/networking/dns/zones/{zone_id} — Update zone email, default TTL, description, or VPC association.
  • DELETE /api/v1/networking/dns/zones/{zone_id} — Delete a DNS zone and purge all records from PowerDNS.

DNS Recordsets & VIP Binding​

  • GET /api/v1/networking/dns/zones/{zone_id}/recordsets — List all recordsets inside a DNS zone.
  • POST /api/v1/networking/dns/zones/{zone_id}/recordsets — Create or update a recordset (A, AAAA, CNAME, MX, TXT, SRV, PTR, NS, CAA).
  • PATCH /api/v1/networking/dns/zones/{zone_id}/recordsets/{recordset_id} — Modify record values, TTL, or description.
  • DELETE /api/v1/networking/dns/zones/{zone_id}/recordsets/{recordset_id} — Delete a recordset from the zone.
  • POST /api/v1/networking/dns/zones/{zone_id}/bind-vip — 1-click bind a domain/subdomain to an Octavia Load Balancer VIP with optional automatic Reverse DNS (PTR) creation.

Multi-Tenant Isolation & Row-Level Security (RLS)​

Okustera DNSaaS enforces strict multi-tenancy across every layer of the stack:

  1. Keystone Project & Designate Header Isolation:
    • Every DNS API call resolves the caller's Keystone project ID (get_current_project_id) and passes X-Auth-Sudo-Project-Id: <PROJECT_ID> to OpenStack Designate so zones are partitioned by project in Designate and PowerDNS.
  2. Dual-Layer Database Isolation (dns_zones & dns_recordsets):
    • Both DnsZoneRecord and DnsRecordsetRecord inherit TenantScopedMixin (Tier A) and are protected by SQLAlchemy do_orm_execute/before_flush session interceptors and PostgreSQL FORCE ROW LEVEL SECURITY (omc_rls_dns_zones_isolation and omc_rls_dns_recordsets_isolation).
    • Cross-tenant read, update, or delete attempts against another tenant's zone_id or recordset_id are blocked at both the ORM and PostgreSQL storage engine layers (HTTP 404 Not Found).
  3. Global RFC 1035 Domain Conflict Prevention:
    • While zone inventories and recordsets are strictly private to their owning tenant, POST /api/v1/networking/dns/zones enforces global domain name uniqueness (HTTP 409 Conflict) so a second tenant cannot hijack or shadow an already-registered authoritative domain.
    • For complete details on database-level isolation, see Database Multi-Tenancy & Row-Level Security (/security/multitenancy-rls).