Add multi-tenant DNS server for external and tenant use
This commit is contained in:
govardhan
220
DNS-SERVER-GUIDE.md
Normal file
220
DNS-SERVER-GUIDE.md
Normal file
@ -0,0 +1,220 @@
|
||||
# Multi-Tenant DNS Server Setup
|
||||
|
||||
## 🎯 Overview
|
||||
|
||||
This DNS server provides:
|
||||
- **External DNS** for connectvm.cloud (public access)
|
||||
- **Multi-tenant DNS** for dev, prod, and QA teams
|
||||
- **High Availability** with 3 replicas
|
||||
- **Metrics** for monitoring
|
||||
|
||||
## 🌐 DNS Zones Configured
|
||||
|
||||
### 1. Main Domain: `connectvm.cloud`
|
||||
**Public DNS for main services**
|
||||
|
||||
Available records:
|
||||
- `rancher.connectvm.cloud` → 160.30.114.10
|
||||
- `paste.connectvm.cloud` → 160.30.114.10
|
||||
- `fleet.connectvm.cloud` → 160.30.114.10
|
||||
- `hello.connectvm.cloud` → 160.30.114.10
|
||||
- `dns.connectvm.cloud` → 160.30.114.10
|
||||
- `*.connectvm.cloud` → 160.30.114.10 (wildcard)
|
||||
|
||||
### 2. Dev Team: `dev.connectvm.cloud`
|
||||
**Development team's DNS zone**
|
||||
|
||||
Available records:
|
||||
- `app1.dev.connectvm.cloud`
|
||||
- `app2.dev.connectvm.cloud`
|
||||
- `api.dev.connectvm.cloud`
|
||||
- `web.dev.connectvm.cloud`
|
||||
- `dashboard.dev.connectvm.cloud`
|
||||
- `jenkins.dev.connectvm.cloud`
|
||||
- `gitlab.dev.connectvm.cloud`
|
||||
- `db.dev.connectvm.cloud`
|
||||
- `redis.dev.connectvm.cloud`
|
||||
- `*.dev.connectvm.cloud` (wildcard)
|
||||
|
||||
### 3. Prod Team: `prod.connectvm.cloud`
|
||||
**Production team's DNS zone**
|
||||
|
||||
Available records:
|
||||
- `api.prod.connectvm.cloud`
|
||||
- `web.prod.connectvm.cloud`
|
||||
- `app.prod.connectvm.cloud`
|
||||
- `admin.prod.connectvm.cloud`
|
||||
- `portal.prod.connectvm.cloud`
|
||||
- `db.prod.connectvm.cloud`
|
||||
- `monitoring.prod.connectvm.cloud`
|
||||
- `*.prod.connectvm.cloud` (wildcard)
|
||||
|
||||
### 4. QA Team: `qa.connectvm.cloud`
|
||||
**QA/Testing team's DNS zone**
|
||||
|
||||
Available records:
|
||||
- `test.qa.connectvm.cloud`
|
||||
- `staging.qa.connectvm.cloud`
|
||||
- `selenium.qa.connectvm.cloud`
|
||||
- `automation.qa.connectvm.cloud`
|
||||
- `reports.qa.connectvm.cloud`
|
||||
- `*.qa.connectvm.cloud` (wildcard)
|
||||
|
||||
## 🔧 External Access
|
||||
|
||||
### DNS Server IPs:
|
||||
- **Primary**: `160.30.114.10:30053` (UDP/TCP)
|
||||
- **Internal**: `10.96.100.100:53` (ClusterIP)
|
||||
|
||||
### Configure Clients to Use DNS:
|
||||
|
||||
**Linux/Mac:**
|
||||
```bash
|
||||
# Add to /etc/resolv.conf
|
||||
nameserver 160.30.114.10
|
||||
|
||||
# Or use specific port with dig:
|
||||
dig @160.30.114.10 -p 30053 rancher.connectvm.cloud
|
||||
```
|
||||
|
||||
**Windows:**
|
||||
```powershell
|
||||
# Set DNS server
|
||||
netsh interface ip set dns "Ethernet" static 160.30.114.10
|
||||
```
|
||||
|
||||
**Kubernetes Pods:**
|
||||
```yaml
|
||||
spec:
|
||||
dnsPolicy: None
|
||||
dnsConfig:
|
||||
nameservers:
|
||||
- 10.96.100.100
|
||||
searches:
|
||||
- connectvm.cloud
|
||||
- dev.connectvm.cloud
|
||||
```
|
||||
|
||||
## 📊 Monitoring
|
||||
|
||||
Access DNS metrics:
|
||||
- **URL**: https://dns.connectvm.cloud/metrics
|
||||
- **Prometheus endpoint**: Port 9153
|
||||
|
||||
Metrics include:
|
||||
- Query count
|
||||
- Query types
|
||||
- Response codes
|
||||
- Cache hit/miss rates
|
||||
- Zone transfer stats
|
||||
|
||||
## 🔒 Security Features
|
||||
|
||||
- **Zone isolation**: Each tenant has separate DNS zone
|
||||
- **No zone transfers**: Zones are read-only
|
||||
- **Query logging**: All queries are logged
|
||||
- **Rate limiting**: Built-in caching (300s TTL)
|
||||
|
||||
## 🛠️ Management
|
||||
|
||||
### Add New Record:
|
||||
|
||||
1. Edit `dns-server.yaml` ConfigMap
|
||||
2. Add record to appropriate zone file
|
||||
3. Increment Serial number
|
||||
4. Git push → Fleet auto-deploys
|
||||
|
||||
**Example** - Add new dev app:
|
||||
```
|
||||
newapp IN A 160.30.114.10
|
||||
```
|
||||
|
||||
### Add New Tenant Zone:
|
||||
|
||||
1. Create new zone file in ConfigMap
|
||||
2. Add zone to Corefile
|
||||
3. Git push
|
||||
|
||||
## 🧪 Testing
|
||||
|
||||
Test DNS resolution:
|
||||
```bash
|
||||
# Test main domain
|
||||
dig @160.30.114.10 -p 30053 rancher.connectvm.cloud
|
||||
|
||||
# Test dev tenant
|
||||
dig @160.30.114.10 -p 30053 app1.dev.connectvm.cloud
|
||||
|
||||
# Test prod tenant
|
||||
dig @160.30.114.10 -p 30053 api.prod.connectvm.cloud
|
||||
|
||||
# Test QA tenant
|
||||
dig @160.30.114.10 -p 30053 test.qa.connectvm.cloud
|
||||
|
||||
# Test wildcard
|
||||
dig @160.30.114.10 -p 30053 anything.dev.connectvm.cloud
|
||||
```
|
||||
|
||||
## 📱 Use Cases
|
||||
|
||||
### For Dev Team:
|
||||
```bash
|
||||
# Deploy app with custom DNS
|
||||
kubectl create deployment myapp --image=nginx
|
||||
kubectl expose deployment myapp --port=80
|
||||
|
||||
# Access via: myapp.dev.connectvm.cloud
|
||||
```
|
||||
|
||||
### For Prod Team:
|
||||
```bash
|
||||
# Production API endpoint
|
||||
api.prod.connectvm.cloud → Production API server
|
||||
```
|
||||
|
||||
### For QA Team:
|
||||
```bash
|
||||
# Automated testing
|
||||
selenium.qa.connectvm.cloud → Selenium Grid
|
||||
automation.qa.connectvm.cloud → Test Runner
|
||||
```
|
||||
|
||||
## 🚀 High Availability
|
||||
|
||||
- **3 replicas** across different nodes
|
||||
- **Anti-affinity** rules for pod distribution
|
||||
- **Auto-restart** on failure
|
||||
- **Health checks** every 10 seconds
|
||||
|
||||
## 📝 DNS Server Info
|
||||
|
||||
- **Software**: CoreDNS 1.11.1
|
||||
- **Protocol**: DNS (UDP/TCP port 53)
|
||||
- **Upstream**: Google DNS (8.8.8.8, 8.8.4.4)
|
||||
- **Cache TTL**: 300 seconds
|
||||
- **Zone TTL**: 3600 seconds (1 hour)
|
||||
|
||||
## 🎯 Architecture
|
||||
|
||||
```
|
||||
External Queries (port 30053)
|
||||
↓
|
||||
NodePort Service
|
||||
↓
|
||||
DNS Pods (3 replicas)
|
||||
↓
|
||||
┌─────────────┬──────────────┬─────────────┐
|
||||
│ Main Zone │ Dev Zone │ Prod Zone │
|
||||
│ qa Zone │ K8s DNS │ Upstream │
|
||||
└─────────────┴──────────────┴─────────────┘
|
||||
```
|
||||
|
||||
## 🔄 Updates
|
||||
|
||||
All DNS updates happen via GitOps:
|
||||
1. Edit zone files in Git
|
||||
2. Push to Gitea
|
||||
3. Fleet auto-deploys in ~15 seconds
|
||||
4. DNS records updated automatically
|
||||
|
||||
No manual DNS server management needed!
|
||||
Reference in New Issue
Block a user