to be clear that naming isn’t a hill i will die on - i just want to make sure we build in knowing where we have things situated if our gear ends up dispersed across multiple data centers or locations.
The consideration of putting physical location of resources in the hostname and fqdn is good, the hostname might a bit overly verbose for my personal tastes given the fqdn, but too much verbosity is better than not enough for this. I think it’s a reasonable set of things to include.
For internal DNS, FreeIPA will either need to control the rockylinux.org domain as name servers or another DNS server will need to be managed with all the special DNS records (I don’t like the latter, it is very painful to manage - having IPA manage it would be ideal here).
If we want seamless identity management/idp, freeipa needs to be at the top to manage kerberos and other functionality of the system, including DNS records, KRA, CA, among other things. Having an “idp” subdomain is perfectly fine for having ipsilon and the like for that specific functionality, but we should be aware where the core of the identities need to sit, top level. As long as FreeIPA has control over the internal domains and reverse zones, it will work very well for our needs.
@neil Internally, yes. FreeIPA doesn’t care about external domains because it doesn’t do views. For example, my domain angelsofclockwork.net. I have external records hosted somewhere else but my IPA domain is still angelsofclockwork.net internally, held by my IPA servers. Changes I do there do not reflect external changes. My external changes are done elsewhere. This system is doable.
Edit, here’s what I mean.
# dig mgt.angelsofclockwork.net @10.100.0.231 A
; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> mgt.angelsofclockwork.net @10.100.0.231 A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44108
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 7
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 8a05702cb5025ce046ce117d5fd1343321297e13edf40253 (good)
;; QUESTION SECTION:
;mgt.angelsofclockwork.net. IN A
;; ANSWER SECTION:
mgt.angelsofclockwork.net. 1200 IN A 10.100.0.10
;; AUTHORITY SECTION:
angelsofclockwork.net. 60 IN NS ipa02.angelsofclockwork.net.
angelsofclockwork.net. 60 IN NS ipa01.angelsofclockwork.net.
angelsofclockwork.net. 60 IN NS router.angelsofclockwork.net.
;; ADDITIONAL SECTION:
router.angelsofclockwork.net. 1200 IN A 10.100.0.1
ipa01.angelsofclockwork.net. 1200 IN A 10.100.0.231
ipa02.angelsofclockwork.net. 1200 IN A 10.100.0.232
router.angelsofclockwork.net. 1200 IN AAAA 2001:470:1f19:138::1
ipa01.angelsofclockwork.net. 1200 IN AAAA 2001:470:1f19:138::231
ipa02.angelsofclockwork.net. 1200 IN AAAA 2001:470:1f19:138::232
;; Query time: 0 msec
;; SERVER: 10.100.0.231#53(10.100.0.231)
;; WHEN: Wed Dec 09 13:31:47 MST 2020
;; MSG SIZE rcvd: 291
# dig mgt.angelsofclockwork.net @8.8.8.8 A
; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> mgt.angelsofclockwork.net @8.8.8.8 A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37100
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;mgt.angelsofclockwork.net. IN A
;; Query time: 19 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Dec 09 13:32:27 MST 2020
;; MSG SIZE rcvd: 54
Fair, We were initially talking about distributed so i wasn’t thinking DC but in that case i updated ref specifying the. dc us1 de1 is just an example. could be alphanumeric as well. more important is the registry IE: Netbox of those sytems
If I’m understanding it right you set it up at the root but you make use of split-brain DNS so external requests are unaffected but internal auth is routed correctly.
Somebody please correct me if I don’t have that right.
Split DNS is only problematic if you set it up poorly. I have done this at multiple clients and have it running personally at home with no issues. Regardless if you subdomain or not, you’re going to have to do split DNS for the infrastructure.
We’ve never had problems with Split DNS configured under Bind9
The general scheme from first post looks ok, but I would put ID as last thing to follow “from biggest to smallest” scheme, so for eg: dev-us1-001.ci.rockylinux.org dev-de1-001.ci.rockylinux.org prod-de1-001.idp.rockylinux.org dev-us1-001.idp.rockylinux.org
us1/de1 are under dev and host 001 from dev-us1 is… well… under dev-us1
(and question do we even need 3digits here? maybe 2 digita is enough? do you really plan to have more than 99 servers in single DC?)
@morsik I agree, largest to smallest completely makes sense. updated to reflect the translation and decrease to two digits I have just generally used 3 for ids in the past due to large numbers of servers but 2 makes sense.
