Skip to content

Commit 5f72c2e

Browse files
wmudgewmudge
committed
Add FreeIPA DNS for ECS role
Signed-off-by: Webster Mudge <[email protected]>
1 parent 8725267 commit 5f72c2e

File tree

11 files changed

+910
-0
lines changed

11 files changed

+910
-0
lines changed

‎roles/freeipa_server_ecs/README.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# freeipa_server_ecs
2+
3+
Configure DNS zones and wildcard records for Cloudera ECS.
4+
5+
This role configures DNS zones and wildcard records within a **FreeIPA** server, which is a key step for Cloudera on Premise **Embedded Container Service (ECS)**. It simplifies the process of setting up name resolution for applications and services within a specific domain by automatically creating a DNS zone and populating it with wildcard DNS records pointing to a single IP address.
6+
7+
The role will:
8+
- Authenticate to a FreeIPA server using the provided administrative credentials.
9+
- Create a new DNS zone based on the `ipaserver_domain` and the `zone_name` defined in the `freeipa_dns_records` list.
10+
- Add wildcard DNS records (`*` records) to the specified zone.
11+
- Point these wildcard records to the target IP address defined in `freeipa_dns_records_address`.
12+
- Optionally, skip a check for overlapping DNS zones if `dnszone_skip_overlap_check` is set to `true`.
13+
- Execute all commands via the FreeIPA API, either on a client or server context.
14+
15+
## Requirements
16+
17+
- A running and accessible **FreeIPA server**.
18+
- The `ipaadmin_principal` must have permissions to create DNS zones and records within the FreeIPA environment.
19+
- Network connectivity from the Ansible controller (or the `ipaapi_context` host) to the FreeIPA server.
20+
21+
## Dependencies
22+
23+
None.
24+
25+
## Parameters
26+
27+
| Variable | Type | Required | Default | Description |
28+
| --- | --- | --- | --- | --- |
29+
| `ipaadmin_password` | `str` | `True` | | **FreeIPA** administrative password for authentication. |
30+
| `ipaadmin_principal` | `str` | `False` | `admin` | **FreeIPA** administrative principal (user) for authentication. |
31+
| `ipaserver_host` | `str` | `False` | `inventory_hostname` | Hostname or IP address of the **FreeIPA** server to connect to. Defaults to the current host. |
32+
| `ipaserver_domain` | `str` | `True` | | The **FreeIPA** domain under which the DNS zone will be created (e.g., `example.internal`). |
33+
| `freeipa_dns_records` | `list` of `dict` | `False` | `[{'zone_name': 'apps.{{ ipaserver_domain }}', 'record_name': '*', 'record_type': 'A'}, {'zone_name': '{{ ipaserver_domain }}', 'record_name': '*', 'record_type': 'A'}]` | A list of DNS records to create within the specified **FreeIPA** domain. Each dictionary defines a record with its `zone_name`, `record_name`, and `record_type`. Defaults to creating two wildcard A records. |
34+
| `freeipa_dns_records_address` | `str` | `True` | | The target IP address for the DNS records defined in `freeipa_dns_records`. All records will point to this address. |
35+
| `dnszone_skip_overlap_check` | `bool` | `False` | `false` | A flag to skip the overlap check when creating DNS zones, which can be useful in specific configurations but should be used with caution. |
36+
| `ipaapi_context` | `str` | `False` | - | The **FreeIPA** role of the host where the DNS Zone creation command will be executed. Choices are `client` or `server`. |
37+
38+
## Example Playbook
39+
40+
```yaml
41+
- hosts: ipaserver_host
42+
tasks:
43+
- name: Configure FreeIPA DNS for ECS with default wildcard records
44+
ansible.builtin.import_role:
45+
name: cloudera.exe.freeipa_server_ecs
46+
vars:
47+
ipaadmin_password: "MySuperSecretAdminPassword" # Use Ansible Vault for this
48+
ipaserver_domain: "example.internal"
49+
freeipa_dns_records_address: "10.0.0.100"
50+
# The role will automatically create '*' records for 'apps.example.internal' and 'example.internal'
51+
52+
- name: Configure a single custom DNS record for ECS
53+
ansible.builtin.import_role:
54+
name: cloudera.exe.freeipa_server_ecs
55+
vars:
56+
ipaadmin_password: "MySuperSecretAdminPassword"
57+
ipaserver_domain: "example.internal"
58+
freeipa_dns_records_address: "10.0.0.200"
59+
freeipa_dns_records:
60+
- zone_name: "custom.{{ ipaserver_domain }}"
61+
record_name: "customapp"
62+
record_type: "A"
63+
dnszone_skip_overlap_check: true
64+
ipaapi_context: "client"
65+
```
66+
67+
## License
68+
69+
```
70+
Copyright 2025 Cloudera, Inc.
71+
72+
Licensed under the Apache License, Version 2.0 (the "License");
73+
you may not use this file except in compliance with the License.
74+
You may obtain a copy of the License at
75+
76+
https://www.apache.org/licenses/LICENSE-2.0
77+
78+
Unless required by applicable law or agreed to in writing, software
79+
distributed under the License is distributed on an "AS IS" BASIS,
80+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
81+
See the License for the specific language governing permissions and
82+
limitations under the License.
83+
```

‎roles/freeipa_server_ecs/defaults/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
ipaadmin_principal: admin
17+
ipaadmin_password: "{{ undef(hint='Please define the FreeIPA adminstrator principal password') }}"
18+
ipaserver_domain: "{{ undef(hint='Please define the FreeIPA server domain') }}"
19+
ipaserver_host: "{{ inventory_hostname }}"
20+
# ipaapi_context:
21+
22+
dnszone_skip_overlap_check: false
23+
24+
freeipa_dns_records:
25+
- zone_name: "apps.{{ ipaserver_domain }}"
26+
record_name: "*"
27+
record_type: "A"
28+
29+
freeipa_dns_records_address: "{{ undef(hint='Please define the FreeIPA DNS records target IP address for ECS') }}"

‎roles/freeipa_server_ecs/meta/argument_specs.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
# Copyright 2025 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
argument_specs:
17+
main:
18+
short_description: Configure DNS zones and wildcard records for ECS
19+
description:
20+
- Ensures that DNS zones and wildcard records are set up in FreeIPA for ECS.
21+
- Creates a specified DNS zone and adds wildcard DNS records.
22+
author: Cloudera Labs
23+
options:
24+
ipaadmin_password:
25+
description: FreeIPA admin password used for authentication.
26+
required: true
27+
ipaadmin_principal:
28+
description: FreeIPA admin principal used for authentication.
29+
default: admin
30+
ipaserver_host:
31+
description: Hostname or IP address of the FreeIPA server.
32+
default: C(inventory_hostname)
33+
ipaserver_domain:
34+
description: The FreeIPA domain to use for creating the DNS zone and records.
35+
required: true
36+
freeipa_dns_records:
37+
description: DNS records to create within the FreeIPA domain, i.e. DNS zone.
38+
type: list
39+
elements: dict
40+
options:
41+
zone_name:
42+
description: Name of the DNS zone to create the record in.
43+
required: true
44+
record_name:
45+
description: Name of the DNS record (use C(*) for a wildcard record).
46+
required: true
47+
record_type:
48+
description: Type of the DNS record (e.g., A, AAAA).
49+
required: true
50+
default:
51+
- zone_name: "apps.C(ipaserver_domain)"
52+
record_name: "*"
53+
record_type: "A"
54+
- zone_name: "C(ipaserver_domain)"
55+
record_name: "*"
56+
record_type: "A"
57+
freeipa_dns_records_address:
58+
description: DNS records target IP address for the records defined in O(freeipa_dns_records).
59+
type: str
60+
required: true
61+
dnszone_skip_overlap_check:
62+
description: Skip overlap check when creating DNS zones.
63+
type: bool
64+
required: false
65+
default: false
66+
ipaapi_context:
67+
description: The FreeIPA role of the host where the DNS Zone creation will execute.
68+
type: str
69+
required: false
70+
choices:
71+
- client
72+
- server

‎roles/freeipa_server_ecs/molecule/default/converge.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
# Copyright 2024 Cloudera, Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# https://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
- name: Converge
17+
hosts: all
18+
gather_facts: true
19+
tasks:
20+
- name: Provision ECS DNS entries
21+
ansible.builtin.import_role:
22+
name: cloudera.exe.freeipa_server_ecs
23+
vars:
24+
freeipa_dns_records_address: "{{ ansible_default_ipv4.address }}"

0 commit comments

Comments
 (0)