Enable dnsmasq as a system job that runs everywhere #1976
Conversation
ghost
self-assigned this
For AWS we need a way to change Nomad jobs so that they get dns from localhost:8600 (the Consul agent). Ideally we'd be able to do dns_server = localhost:8600, but that isn't supported. Looking at the docker docs, they kinda support it using published ports (ie mapping host ports to different ports in containers ie the reverse of normal port mapping where we publish container ports to a different host port). Nomad doesn't support published ports that I can find. As such, the easiest thing to do is to use dnsmasq as a dns forwarder. Note: We're using containerized dnsmasq instead of host-based dnsmasq that way we only have one place we're setting up dns
ghost
force-pushed
the
twunderlich/dnsmasq-in-aws
branch
from
62d0b45
to
a4893bc
Compare
|
|
||
| config { | ||
| #This is an alpine-based dnsmasq container | ||
| image = "4km3/dnsmasq:2.85-r2" |
There was a problem hiding this comment.
Long-term we'll want to switch this to either an official dnsmasq container or one that we build
| ports = ["dns"] | ||
| args = [ | ||
| # Send all queries for .consul to the NOMAD_IP | ||
| "--server", "/consul/${NOMAD_IP_dns}#8600", |
There was a problem hiding this comment.
Note to self: doublecheck why we're doing it this way. It probably makes sense to switch to attr.unique.network.ip-address
There was a problem hiding this comment.
(how likely are we to actually follow up on this lol)
There was a problem hiding this comment.
This part seems like it will work both ways, so I'm going to leave it
|
I still need to do some testing with this, but this is generally the approach I'd like to take to forward dns to the local Consul agent. As an overview the dns call chain will look like Some risks that we need to take a look at: |
Codecov ReportBase: 44.17% // Head: 44.17% // Increases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## main #1976 +/- ##
=======================================
Coverage 44.17% 44.17%
=======================================
Files 473 473
Lines 13381 13382 +1
Branches 23 23
=======================================
+ Hits 5911 5912 +1
Misses 7455 7455
Partials 15 15
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
| ports = ["dns"] | ||
| args = [ | ||
| # Send all queries for .consul to the NOMAD_IP | ||
| "--server", "/consul/${NOMAD_IP_dns}#8600", |
There was a problem hiding this comment.
(how likely are we to actually follow up on this lol)
pulumi/grapl/__main__.py
Outdated
| custom_timeouts=CustomTimeouts( | ||
| create=nomad_grapl_core_timeout, update=nomad_grapl_core_timeout | ||
| ), |
There was a problem hiding this comment.
honestly we prob don't need this for a single image
|
I've investigated alternative approaches:
|
Which issue does this PR correspond to?
https://github.com/grapl-security/issue-tracker/issues/1011
What changes does this PR make to Grapl? Why?
For AWS we need a way to change Nomad jobs so that they get dns from localhost:8600 (the Consul agent). Ideally we'd be able to do dns_server = localhost:8600, but that isn't supported. Looking at the docker docs, they kinda support it using published ports (ie mapping host ports to different ports in containers ie the reverse of normal port mapping where we publish container ports to a different host port). Nomad doesn't support published ports that I can find. As such, the easiest thing to do is to use dnsmasq as a dns forwarder.
Note: We're using containerized dnsmasq instead of host-based dnsmasq that way we only have one place we're setting up dns
How were these changes tested?