[WIP] ipaclient: Configure DNS resolver #644
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ipaclient_setup_nss is using the nosssd_files dict if sssd is disabled with no_sssd. The nosssd_files dict is generated in ipaclient_test and used in ipaclient_setup_nss. So far ipaclient_setup_nss was using nosssd_files from ipaclient installer, which was always None.
Optionally configure global DNS resolver NetworkManager, systemd-resolved or /etc/resolv.conf within ipaclient_test. The configuration of NetworkManager, systemd-resolved and /etc/resolv.conf is done in the same way as on the initial master. For NetworkManager the file '/etc/NetworkManager/conf.d/zzz-ipa.conf' will be generated, for system-resolved '/etc/systemd/resolved.conf.d/zzz-ipa.conf'. New functions in ansible_ipa_client: configure_dns_resolver Configures global DNS resolver NetworkManager, systemd-resolved or /etc/resolv.conf unconfigure_dns_resolver Reverts global DNS resolver configuration New parameters for the role: ipaclient_configure_dns_resolver The bool value defines if the DNS resolver will be configured. NetworkManager and systemd-resolved will be configured if enabled else /etc/resolv.conf will be adapted. `ipaclient_configure_dns_resolver` defaults to `no` ipaclient_dns_servers List of DNS servers to use if `ipaclient_configure_dns_resolver` is enabled. If `ipaclient_dns_servers` is not defined, the list will be generated from `ipaclient_servers` or `ipaservers` group. ipaclient_dns_domain_name List of DNS search domain names to use if `ipaclient_configure_dns_resolver` is enabled. if `ipaclient_dns_domain_names` the list will be generated using the domain name.
fcami
reviewed
Sep 23, 2021
There was a problem hiding this comment.
I don't think we should ever activate systemd-resolved for reasons detailed there.
On clients its performance is less than optimal.
On servers, this breaks IPA's DNS zone detection.
Plus, it is not clear when systemd-resolved will be supported in any enterprise distribution.
t-woerner
changed the title
|
Shouldn't this be carried out by something like Network Linux System Role? Also, does this work with Ubuntu's |
|
The code for system-resolved needs to be kept in the ipaclient role even with a change in FreeIPA to deactivate systemd-resolved on servers and replicas. |
|
This PR has been replaced by #988, which was already merged. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Optionally configure global DNS resolver NetworkManager, systemd-resolved
or /etc/resolv.conf within ipaclient_test.
The configuration of NetworkManager, systemd-resolved and /etc/resolv.conf
is done in the same way as on the initial master. For NetworkManager the
file '/etc/NetworkManager/conf.d/zzz-ipa.conf' will be generated, for
system-resolved '/etc/systemd/resolved.conf.d/zzz-ipa.conf'.
New functions in ansible_ipa_client:
configure_dns_resolver
Configures global DNS resolver NetworkManager, systemd-resolved or
/etc/resolv.conf
unconfigure_dns_resolver
Reverts global DNS resolver configuration
New parameters for the role:
ipaclient_configure_dns_resolver
The bool value defines if the DNS resolver will be configured.
NetworkManager and systemd-resolved will be configured if enabled else
/etc/resolv.conf will be adapted.
ipaclient_configure_dns_resolverdefaults to
noipaclient_dns_servers
List of DNS servers to use if
ipaclient_configure_dns_resolverisenabled. If
ipaclient_dns_serversis not defined, the list will begenerated from
ipaclient_serversoripaserversgroup.ipaclient_dns_domain_name
List of DNS search domain names to use if
ipaclient_configure_dns_resolveris enabled. ifipaclient_dns_domain_namesthe list will be generated using the domainname.
This PR depends on changes from PR #643 (ipaclient_setup_nss: Use proper nosssd_files list)