*** haplo37_ has joined #openstack-dns | 01:34 | |
*** ducttape_ has quit IRC | 02:18 | |
*** ducttape_ has joined #openstack-dns | 02:25 | |
*** nyechiel has joined #openstack-dns | 02:39 | |
*** rudrajit has quit IRC | 02:50 | |
*** mlavalle has joined #openstack-dns | 03:11 | |
*** richm has quit IRC | 03:19 | |
*** fawadkhaliq has joined #openstack-dns | 03:20 | |
*** mlavalle has quit IRC | 03:29 | |
*** rudrajit has joined #openstack-dns | 03:31 | |
*** fawadkhaliq has quit IRC | 03:34 | |
*** ducttape_ has quit IRC | 03:36 | |
*** rudrajit has quit IRC | 03:45 | |
*** rudrajit has joined #openstack-dns | 03:46 | |
*** Krenair has joined #openstack-dns | 03:56 | |
Krenair | I tried to create a domain under in-addr.arpa, then add a record to it | 03:58 |
---|---|---|
Krenair | using the v1 api through python-designateclient | 03:58 |
Krenair | unfortunately the record creation results in an HTTP 400 - designateclient.exceptions.BadRequest: Provided object does not match schema | 03:58 |
openstackgerrit | gecong proposed openstack/designate: Remove unused LOG https://review.openstack.org/344554 | 04:00 |
*** abalutoiu has quit IRC | 04:01 | |
Krenair | it went something like this: | 04:02 |
Krenair | domain = designaterecords.Domain(name="128-25.123.123.123.in-addr.arpa.", email="example@example.org") | 04:02 |
Krenair | res = designate_client.domains.create(domain) | 04:02 |
Krenair | # res['id'] == '933a78c2-3d8d-4ee1-bbef-9ab30be5f972' | 04:02 |
Krenair | record = designaterecords.Record(name="129.128-25.123.123.123.in-addr.arpa", type="PTR", data="our.domain.org", description="some text") | 04:02 |
Krenair | result = designate_client.records.create('933a78c2-3d8d-4ee1-bbef-9ab30be5f972', record) | 04:02 |
Krenair | So I looked through /var/log/designate and found this in designate-pool-manager.log: | 04:02 |
Krenair | https://gist.github.com/Krenair/aa656d7e124ca828ceb180e29396b7a3 | 04:04 |
Krenair | oh, this is with the pdns backend | 04:05 |
Krenair | Why is it trying to create the domain again? We're at the record creation stage when stuff goes wrong, and the database already contains the domain | 04:05 |
Krenair | I do notice that it attempts to insert with account None (NULL in mysql I guess), but it's supposed to be using my project's name | 04:08 |
*** abalutoiu has joined #openstack-dns | 04:14 | |
*** fawadkhaliq has joined #openstack-dns | 04:16 | |
*** fawadkhaliq has quit IRC | 04:20 | |
*** Alex_Stef has joined #openstack-dns | 05:11 | |
*** haplo37_ has quit IRC | 05:52 | |
*** stanzgy has joined #openstack-dns | 06:20 | |
*** Alex_Stef has quit IRC | 06:31 | |
*** rudrajit_ has joined #openstack-dns | 06:33 | |
*** rudrajit has quit IRC | 06:37 | |
*** rudrajit_ has quit IRC | 07:05 | |
*** rudrajit has joined #openstack-dns | 07:06 | |
*** rudrajit has quit IRC | 07:10 | |
*** rudrajit has joined #openstack-dns | 07:36 | |
*** rudrajit has quit IRC | 07:42 | |
*** Alex_Stef has joined #openstack-dns | 08:15 | |
*** fawadkhaliq has joined #openstack-dns | 08:47 | |
*** fawadkhaliq has quit IRC | 08:47 | |
*** fawadkhaliq has joined #openstack-dns | 08:48 | |
*** fawadkhaliq has quit IRC | 08:48 | |
*** fawadkhaliq has joined #openstack-dns | 08:50 | |
*** fawadkhaliq has quit IRC | 08:52 | |
*** fawadkhaliq has joined #openstack-dns | 08:52 | |
*** fawadkhaliq has quit IRC | 08:56 | |
Kiall | Krenair: "129.128-25.123.123.123.in-addr.arpa" would be the issue - well - 2 issues... it should end with a period (.) and, I'm not certain our validation will allow the 128-25 through | 10:53 |
*** stanzgy has quit IRC | 11:00 | |
Kiall | Krenair: oh, also.. re the domain re-create, I'd bet thats from running the script twice. `res = designate_client.domains.create(domain)` will fail the second time around as it already exists | 11:47 |
*** ducttape_ has joined #openstack-dns | 12:07 | |
*** ducttape_ has quit IRC | 12:12 | |
*** chrido has joined #openstack-dns | 12:31 | |
openstackgerrit | Merged openstack/designate: update doc index, add ops FAQ and notifications https://review.openstack.org/341583 | 12:44 |
*** ducttape_ has joined #openstack-dns | 12:58 | |
*** richm has joined #openstack-dns | 13:04 | |
*** ducttape_ has quit IRC | 13:18 | |
*** abalutoiu_ has joined #openstack-dns | 13:18 | |
*** abalutoiu has quit IRC | 13:21 | |
*** EricGonczer_ has joined #openstack-dns | 13:46 | |
*** ducttape_ has joined #openstack-dns | 13:49 | |
*** Alex_Stef has quit IRC | 14:02 | |
*** abalutoiu__ has joined #openstack-dns | 14:13 | |
*** abalutoiu_ has quit IRC | 14:16 | |
*** pglass has joined #openstack-dns | 14:26 | |
*** EricGonczer_ has quit IRC | 14:26 | |
*** mlavalle has joined #openstack-dns | 14:32 | |
openstackgerrit | Swapnil Kulkarni (coolsvap) proposed openstack/designate: [WIP] Testing latest u-c https://review.openstack.org/318020 | 14:39 |
openstackgerrit | Federico Ceratto proposed openstack/designate: Add gdns devstack plugin https://review.openstack.org/321477 | 14:42 |
*** abalutoiu__ has quit IRC | 14:43 | |
openstackgerrit | Federico Ceratto proposed openstack/designate: Add Monasca-statsd metric generation https://review.openstack.org/322252 | 14:44 |
openstackgerrit | Federico Ceratto proposed openstack/designate: Move unit and functional testing to MySQL https://review.openstack.org/300112 | 14:47 |
*** haplo37_ has joined #openstack-dns | 15:04 | |
Krenair | Kiall, why would it not allow the 128-25 through? | 15:17 |
*** james_li has joined #openstack-dns | 15:18 | |
Kiall | The V1 api uses a validation rule that only allows "1.2.3.4.in-addr.arpa." style names | 15:21 |
Krenair | Kiall, I tried with and without the trailing fulls top | 15:22 |
Kiall | Also 129.128-25.123.123.123.in-addr.arpa just isn't valid - | 15:22 |
Krenair | Kiall, wat? so it completely kills RFC 2317 delegation of in-addr.arpa addresses? | 15:22 |
Kiall | it's got 5 sections for the IP where there should be at most 4 for IPv4 / in-addr.arpa. RR's | 15:22 |
Kiall | Yea, V1 won't accept RFC 2317 | 15:23 |
Krenair | will V2? | 15:23 |
Kiall | It should, though I haven't tested that myself. It's a bug if it doesn't. | 15:24 |
*** james_li has quit IRC | 15:24 | |
Krenair | Isn't it also a bug in V1 as it doesn't? | 15:24 |
Kiall | The V1 API is deprecated, and is getting no new features (supporting 2317 would be a a feature) | 15:25 |
*** krotscheck is now known as krotscheck_dcm | 15:30 | |
*** EricGonczer_ has joined #openstack-dns | 15:30 | |
*** EricGonczer_ has quit IRC | 15:31 | |
Krenair | Kiall, 2317 is a 1998 "best current practice" RFC | 15:33 |
Krenair | conforming DNS implementations should already support everything that it describes | 15:34 |
mugsie | Krenair i would consider it a feature, and as we will be turning the v1 API off by default in the next few months, we will not be making any changes to it, unless they are completely required | 15:44 |
mugsie | we were not RFC 2317 conformant in the v1 API | 15:45 |
Kiall | Yea, it was certainly an oversight that we didn't implement it, but it's not so much a bug as not having implemented it in V12 | 15:57 |
Kiall | V1* | 15:57 |
*** EricGonczer_ has joined #openstack-dns | 16:03 | |
*** dxu has joined #openstack-dns | 16:05 | |
*** EricGonczer_ has quit IRC | 16:07 | |
*** rudrajit has joined #openstack-dns | 16:07 | |
*** EricGonczer_ has joined #openstack-dns | 16:08 | |
*** james_li has joined #openstack-dns | 16:11 | |
Krenair | Well, I found a server with the v2 designate python api bindings | 16:12 |
Krenair | designate_client.recordsets.create raises "designateclient.exceptions.Unknown: Unknown" | 16:13 |
*** EricGonczer_ has quit IRC | 16:14 | |
Krenair | Kiall, looking at the logs it appears to have been attempting to create the domain in the background? | 16:17 |
Kiall | Krenair: I believe that's most likely just running the script your writing twice? (Hard to tell from this angle :)) You have an explicit create domain in it, so running it twice means it'll create it the first time, then fail with a duplicate error the second time | 16:20 |
Krenair | I'm not running some saved script file here | 16:20 |
Krenair | I'm pasting lines into a python console | 16:20 |
Krenair | I'm not continually trying to run designate_client.zones.create, designate already lists the domain in zones.list() | 16:21 |
Krenair | So why does designate_client.recordsets.create trigger a status >= 500? | 16:23 |
*** rudrajit has quit IRC | 16:24 | |
*** rudrajit has joined #openstack-dns | 16:24 | |
*** rudrajit has quit IRC | 16:28 | |
pglass | Krenair: can you fetch the zone in the v2 api and check its status? | 16:30 |
*** v12aml has quit IRC | 16:30 | |
*** v12aml has joined #openstack-dns | 16:33 | |
pglass | also what is the syntax for rfc2317? reading through that I see things like `129.128/26.2.0.192.in-addr.arpa.` and not `129.128-26.2.0.192.in-addr.arpa.` | 16:37 |
pglass | I can create a recordset with type=PTR and name=1.128-25.5.5.in-addr.arpa. | 16:42 |
pglass | but with bind9, this puts `1.128-25.5.5.in-addr.arpa.`as the record name in the zone file | 16:42 |
pglass | based on docs at http://www.zytrax.com/books/dns/ch9/reverse.html, these should be slashes (not dashes) instead. | 16:43 |
Kiall | pglass: the specific syntax is left as an exercise to the reader, the RFC uses /'s - but anything works.. -'s are actually more common from what I understand. | 16:44 |
Kiall | The RFC is mostly definine the pattern to use (CNAME the "real" PTR name to a "virtual" PTR name, where the virtual PTR is in a tenant specific zone) | 16:45 |
Kiall | defines* | 16:45 |
pglass | oh. okay. this is just a combination of cname and ns records in the zone file. so what does it mean in designate to create something like "129.128-25.123.123.in-addr.arpa" as a ptr record? | 16:54 |
Kiall | Well, PTR record would be the wrong name for it.. It's a CNAME, who happens to have a name that would usually only be used for a PTR | 16:56 |
*** sonuk has quit IRC | 16:57 | |
*** EricGonczer_ has joined #openstack-dns | 17:00 | |
openstackgerrit | James Li proposed openstack/designate: Improve performance of recordsets API https://review.openstack.org/328813 | 17:03 |
Krenair | pglass, seems to be in status ERROR | 17:06 |
Krenair | we're not making the CNAME in designate itself | 17:07 |
Krenair | designate is running the server that's being delegated to | 17:07 |
pglass | okay, but nowhere in the rfc does it say you can create a ptr record with a name like 129.128-25.123.123.in-addr.arpa | 17:12 |
pglass | unless that syntax is already valid? | 17:12 |
pglass | i.e. you can delegate blocks of ip address to designate. that's fine. but I don't think there's a "catch all" ptr record. you need one ptr record per ip. | 17:15 |
pglass | but also I've never done this before, so I'm probably wrong | 17:16 |
*** rudrajit has joined #openstack-dns | 17:18 | |
*** penick has joined #openstack-dns | 17:20 | |
*** rudrajit_ has joined #openstack-dns | 17:21 | |
openstackgerrit | Paul Glass proposed openstack/designate-tempest-plugin: Unauthed tests support both v2/v3 identity https://review.openstack.org/341753 | 17:24 |
*** rudrajit has quit IRC | 17:25 | |
*** pcaruana has quit IRC | 17:27 | |
*** EricGonczer_ has quit IRC | 17:28 | |
*** james_li has quit IRC | 17:35 | |
*** ducttape_ has quit IRC | 17:43 | |
*** pglass has quit IRC | 17:50 | |
*** darkxploit has joined #openstack-dns | 17:53 | |
*** dxu_ has joined #openstack-dns | 18:05 | |
*** dxu has quit IRC | 18:05 | |
Krenair | pglass, the record name is of the form 129.128-25.123.123.123.in-addr.arpa. | 18:07 |
Krenair | clients will look up 129.123.123.123.in-addr.arpa. on our production server, find the CNAME to 129.128-25.123.123.123.in-addr.arpa., and that 128-25.123.123.123.in-addr.arpa. is IN NS our designate servers | 18:08 |
Krenair | that just leaves Designate needing a PTR response to 129.128-25.123.123.123.in-addr.arpa. | 18:09 |
*** visbits has joined #openstack-dns | 18:11 | |
Krenair | We have to use classless in-addr.arpa delegation because the IP range given to OpenStack is a /25 - 123.123.123.128 to 123.123.123.255 - we *can't* delegate the whole of 123.123.123.in-addr.arpa to designate | 18:11 |
visbits | I have a successful installation of designate with powerdns, however I'm having issues with consistently snycing zones. It does not send notify to my nameservers after adding new records | 18:12 |
Krenair | And the RfC literally contains this: | 18:12 |
Krenair | $ORIGIN 128/26.2.0.192.in-addr.arpa. | 18:12 |
Krenair | 129 PTR host1.B.domain. | 18:12 |
Krenair | that is 129.128/26.2.0.192.in-addr.arpa. | 18:12 |
Krenair | We will be creating one PTR record per IP | 18:15 |
*** ducttape_ has joined #openstack-dns | 18:28 | |
*** _ducttape_ has joined #openstack-dns | 18:29 | |
*** pglass has joined #openstack-dns | 18:31 | |
*** ducttape_ has quit IRC | 18:33 | |
visbits | im seeing notify sent to 127.0.0.1 but my pool isnt configured for that | 18:46 |
visbits | http://pastebin.com/rxQzAMRC | 18:47 |
visbits | anyone see an issue with this? | 18:47 |
*** pcaruana has joined #openstack-dns | 18:48 | |
*** _ducttape_ has quit IRC | 18:59 | |
*** ducttape_ has joined #openstack-dns | 18:59 | |
visbits | my powerdns servers are pulling the latest zone themselves but the master isnt sending notifys to them.. bug report i guess | 19:04 |
pglass | oh i get this now, Krenair. so the only issue is designate doesn't allow you to create a ptr record with five "octets" (one of which is the cidr notation) | 19:05 |
Krenair | it seems that way yes | 19:05 |
pglass | Krenair: i'm testing this out though. in the v2 api, you can create ptr records with more than 4 octets | 19:09 |
*** dxu_ is now known as dxu | 19:09 | |
pglass | and with hyphens | 19:09 |
visbits | also_notifies | 19:09 |
visbits | :( | 19:09 |
Krenair | pglass, that's great... so why is the domain in error state? I presume that's what's causing the record creations to trigger an HTTP 5xx error | 19:10 |
Krenair | and where might I find details about the http error? | 19:11 |
pglass | when designate creates a zone (or when any change to the zone occurs), it updates the zone on the backend "target", and then polls the "nameserver" to see the change show up. | 19:11 |
pglass | if it fails to see the change on the nameserver, the zone will go to error. | 19:12 |
Krenair | seems to be sticking at the pdns backend stage | 19:12 |
pglass | the pool manager is the one that orchestrates the polling | 19:12 |
Krenair | ah | 19:12 |
pglass | but the pool manager asks mdns to actually do the queries | 19:12 |
pglass | if you dig you powerdns server and it has the zone/recordset you last created, then there is an issue with the polling. | 19:14 |
pglass | if the nameserver doesn't have it, then there was an issue with putting the zone/recordset on the nameserver | 19:14 |
visbits | when you add a pdns server, is there any provision to create domain records automatically? I've had to dump my db onto it | 19:15 |
Krenair | I don't get the PTR, I get the zone's SOA | 19:15 |
Krenair | so the zone was created | 19:15 |
Krenair | but designate thinks it doesn't - a polling failure at the zone creation stage? | 19:15 |
Krenair | thinks it wasn't* | 19:17 |
pglass | if the soa record is there, then a zone was created. | 19:20 |
Krenair | yep | 19:20 |
pglass | but the nameserver may not have the latest version of the zone from designate (you can compare the zone's serial in designate with the serial in the soa record) | 19:21 |
pglass | what was the 500 error you got? | 19:22 |
pglass | visbits: i think in your pool_target sections, you need `options = host: ..., port: ..., connection: ...` | 19:26 |
visbits | pglass thanks ill give that a shot | 19:27 |
*** ducttape_ has quit IRC | 19:32 | |
visbits | @pglass does not like that | 19:35 |
*** mpbnka has joined #openstack-dns | 19:36 | |
mpbnka | Hi, Can you guys review this https://review.openstack.org/#/c/337416/ | 19:36 |
pglass | visbits: can you paste your new config? and any errors? | 19:36 |
visbits | i added my 2 nameservers to the "also_notify" parameter and that corrected them not being notified.. i feel like thats not the expected behavior | 19:37 |
visbits | im trying to get the sink working but doesnt seem to be getting any messages | 19:37 |
pglass | visbits: i'm not as familiar with powerdns, but do you have something like this in your designate config: http://paste.openstack.org/show/538899/ | 19:40 |
visbits | yeah thats what i have | 19:40 |
visbits | i can add domains no issue | 19:40 |
pglass | visbits: and restarted the pool manager? | 19:42 |
*** mpbnka has quit IRC | 19:45 | |
*** mpbnka has joined #openstack-dns | 19:46 | |
Krenair | pglass, serial in designate is 1468985011, serial returned by pdns is 1468985011 | 19:50 |
Krenair | pglass, HTTP 5xx is indicated by this: https://gist.github.com/Krenair/16894094b7f88649a7a3cb31fde2ccd0 | 19:53 |
pglass | Krenair: can you print the client version you have? `import designateclient.version; print designateclient.version.version_info` | 19:59 |
Krenair | 1.5.0 | 19:59 |
Krenair | would it be helpful if I tried sending the request directly to designate using curl? | 20:04 |
Krenair | and the rest api | 20:04 |
pglass | Krenair: if you have the `openstack` cli, you can do an `openstack --debug zone list` and it should print the requests it makes | 20:06 |
pglass | Krenair: just double checking - your 'nova_api_url' points to a keystone api? | 20:07 |
pglass | in your config | 20:07 |
Krenair | it's like this: http://control.our-domain.org:35357/v2.0 | 20:08 |
Krenair | it's keystone yes | 20:08 |
Krenair | misnamed, probably because I copied that out of a script we used to contact nova | 20:09 |
pglass | but yeah, if you have the response body with the 500 that would help | 20:09 |
pglass | designate should log the exception also | 20:10 |
Krenair | pglass, okay so | 20:10 |
pglass | you can also try create another zone with just a simple A record and see if you get the same error | 20:10 |
Krenair | pglass, openstack --debug zone list doesn't show the in-addr.arpa zones because they are under noauth-project | 20:10 |
Krenair | oh, but I made this particular one jnot with noauth-project, but with an actual tenant | 20:11 |
Krenair | I just need to set OS_TENANT_NAME to that I guess | 20:11 |
Krenair | yep, there it is | 20:11 |
Krenair | my in-addr.arpa zone shows up | 20:11 |
Krenair | status ERROR action CREATE | 20:11 |
pglass | okay so it was an error on the create | 20:11 |
Krenair | yes | 20:12 |
Krenair | ALso, where would designate be logging this? /var/log/designate/designate-api.log ? | 20:12 |
pglass | there is probably one log file per service. if the request 500s though, I think it should be in either the api or in central logs | 20:13 |
Krenair | (I was confused about noauth-project before because I think the 10.in-addr.arpa zone openstack sets up uses that...) | 20:13 |
pglass | the noauth-project is the default tenant designate creates things on, if there is no X-Auth-Project-Id header sent with the api requests. | 20:13 |
Krenair | yeah | 20:39 |
*** pglbutt has joined #openstack-dns | 20:39 | |
Krenair | pglass, I can successfully create an example.org zone and a www record in there | 20:41 |
Krenair | (type A record) | 20:41 |
*** pglass has quit IRC | 20:42 | |
openstackgerrit | Tyr Johanson proposed openstack/designate-dashboard: [WIP] API v2 Dashboard https://review.openstack.org/341182 | 20:43 |
*** abalutoiu has joined #openstack-dns | 20:46 | |
*** abalutoiu has quit IRC | 20:46 | |
*** pcaruana has quit IRC | 20:53 | |
Krenair | I've got something pglbutt | 20:56 |
Krenair | pglass* sorry | 20:56 |
Krenair | who has quit | 20:56 |
pglbutt | they're both me | 20:57 |
Krenair | right, just figured that out :) | 20:57 |
Krenair | I made it print response.text before raising the exception | 20:57 |
Krenair | https://gist.github.com/Krenair/873ecb55546671ae33c11b3bd2f57632 | 20:58 |
pglbutt | umm, where is that from? | 21:00 |
pglbutt | that's in the body of the 500 response? | 21:00 |
Krenair | think so | 21:00 |
Krenair | yep | 21:01 |
pglbutt | do you have the response.request.body? | 21:02 |
pglbutt | i think that's where it is | 21:02 |
Krenair | that is the value of response.text, in /usr/lib/python2.7/dist-packages/designateclient/v2/client.py DesignateAdapter.request | 21:02 |
Krenair | yes | 21:03 |
Krenair | roughly this: {"records": ["something.our-domain.org"], "type": "PTR", "name": "129.128-25.123.123.123.in-addr.arpa.", "description": "Manually created by Alex for testing"} | 21:04 |
Krenair | why does that traceback/exception on the designate server end not show up in /var/log/designate? | 21:10 |
pglbutt | well i've never seen an exception from designate in the response body | 21:12 |
pglbutt | normally, exceptions do show up in the logs | 21:13 |
pglbutt | what version of designate do you have? | 21:13 |
*** rudrajit_ has quit IRC | 21:13 | |
Krenair | >>> designate.version.version_info | 21:16 |
Krenair | pbr.version.VersionInfo(designate:2015.1.0) | 21:16 |
*** rudrajit has joined #openstack-dns | 21:18 | |
*** haplo37_ has quit IRC | 21:27 | |
*** sonuk has joined #openstack-dns | 21:29 | |
openstackgerrit | Tyr Johanson proposed openstack/designate-dashboard: [WIP] API v2 Dashboard https://review.openstack.org/341182 | 21:31 |
*** bsv has joined #openstack-dns | 21:35 | |
Krenair | pglbutt, 2015.1.0 ^ | 21:45 |
*** greghaynes has quit IRC | 21:46 | |
*** greghaynes has joined #openstack-dns | 21:59 | |
*** nyechiel has quit IRC | 21:59 | |
*** EricGonczer_ has joined #openstack-dns | 22:09 | |
*** pglbutt has quit IRC | 22:14 | |
*** mlavalle has quit IRC | 22:35 | |
*** rudrajit has quit IRC | 22:48 | |
*** catintheroof has joined #openstack-dns | 22:52 | |
*** rudrajit has joined #openstack-dns | 23:03 | |
*** bsv has quit IRC | 23:11 | |
*** bsv has joined #openstack-dns | 23:13 | |
*** bsv is now known as Guest58157 | 23:13 | |
*** Guest58157 has quit IRC | 23:18 | |
*** dxu has quit IRC | 23:43 | |
*** penick has quit IRC | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!