Aller au contenu

DNS Architecture#

Here we describe PF dns architecture. To provide DNS resolution over all of our services we have 2 distinct architectures for each of our products: Caascad and NGOT. The solution is built over AWS Route53 and Flexible engine Private DNS Service. Several second level domains are managed through Gandi.

Zone, dns domain and services#

In both Caascad and NGOT we use a data model defining objects named zones. A zone object is associated with one or many dns domains. Those dns domain domains are all subdomains of a second level DNS domain name.

<myzone>.<mydomain>.<mytld>

For example, one of infra-stg zone domain name is: infra-stg.caascad.com.

So we have a 3 level DNS domain architecture. Almost every service provided by a zone object is announced through the 3rd level domain name. So any service FQDN has this form: 

<myservice>.<myzone>.<domain>.<tld>

Ex: ci-infra.infra-stg.caascad.com

The ony exceptions are:

  • SMTP service through MX record on 2nd level DNS domain
  • docker-registry.caascad.com

DNS Recursion architecture#

We have bought several dns domain from Gandi registrar. For every domain a DNS domain has been created in AWS route53. On Gandi side a dns delegation has been set to transfer authority over this domain to our AWS route53 servers (ie: they altered our dns domains glue records on the tld registrar level).

Bind file at the TLD level: 

## .com domain
cloudservicesfactory.com IN NS ns-24.awsdns-03.com.
ns-24.awsdns-03.com. IN A 205.251.192.24

A complete list of NS servers can be found with: 

dig -t NS cloudservicesfactory.com

Gandi also registered them in the whois database: 

whois cloudservicesfactory.com
...
   Name Server: NS-1328.AWSDNS-38.ORG
   Name Server: NS-1992.AWSDNS-57.CO.UK
   Name Server: NS-24.AWSDNS-03.COM
   Name Server: NS-685.AWSDNS-21.NET
...

List of 2nd level dns domains bought:

  • caascad.com: announcing Caascad services
  • caascad.net: announcing Caascad private addresses
  • cloudservicesfactory.com: announcing any NGOT production IP
  • csfpriv.com: announcing any NGOT staging IP

For each zone object we build 0 to n DNS domains. All those zones are subdomains from one of our 2nd level dns domains. For each zone we alter the 2nd level dns domain zone to add a DNS delegation on this zone.

; myzone.cloudservicesfactory.com on aws route 53
    IN NS ns-xx.awsdns-xx.com

; cloudservicesfactory.com zone on AWS route53
myzone IN NS ns-xx.awsdns-xx.com.

This a scheme resuming DNS recursion:

Dns recursion schema

DNS resolution#

Every zone use the cloud providers default DNS resolvers.

DNS management#

To help operators and CI managing DNS objects we have provisioned AWS STS endpoints on infra Vault.

Example where we want to manage DNS staging Caascad zones:

export VAULT_ADDR=https://vault.infra-stg.caascad.com
eval $(vault read aws/sts/power_user_infra-stg -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_SESSION_TOKEN=\(.security_token)"')

toolbox install pkgs.cli53
cli53 list

Caascad#

NGOT#