Aller au contenu

NGOT#

DNS domains and AWS accounts#

In NGOT we use 4 second level DNS domains:

  • csfpriv.com: staging. used to resolve everything
  • cloudservicesfactory.com: prod. used to resolve everything

All zones are stored in one AWS account: ngot (678661912090)

Zones are created for contract zones, admin zone, and the service zone name.

  • obs-*.cloudservicesfactory.com
  • svc.cloudservicesfactory.com
  • admin-prd.cloudservicesfactory.com

Configurations#

DNS zones are created by:

  • aws_dns_zones_ngot (PF context): provides cloudservicesfactory.com and csfpriv.com DNS domains
  • ngot_dns_zones (Caascad context): provides svc.cloudservicesfactory.com admin-prd.cloudservicesfactory.com and obs-*.cloudservicesfactory.com

STS endpoints#

All NGOT zones are managed through STS endpoints on Vault Corp: 

export VAULT_ADDR=https://vault.corp.caascad.com
eval $(vault read aws/sts/ngot-route53 -format=json| jq -r '.data|"export AWS_ACCESS_KEY_ID=\(.access_key)\nexport AWS_SECRET_ACCESS_KEY=\(.secret_key)\nexport AWS_SESSION_TOKEN=\(.security_token)"')
cli53 list

DNS recursion#

Dns recursion schema

On NGOT, a service 'myservice' on 'myzone' will be solved this way:

myservice.myzone.caascad.com -> CNAME ->  loadbalancer_name.myzone.caascad.com -> A -> loadbalancer ip

Example:

 dig git.corp.caascad.com

;; ANSWER SECTION:
git.corp.caascad.com.   95  IN  CNAME   private.corp.caascad.com.
private.corp.caascad.com. 30    IN  A   90.84.246.15

DNS resolution#

In NGOT we have a split horizon DNS setup around the loadbalancer service zone. This specific DNS zone is created on both route53 and FE DNSaaS.

  • On route53 we create a public DNS zone
  • On FE DNSAas we create a private zone (a zone visible only for all NGOT VPCs).

While operators, and clients outside of the NGOT dns network use DNS recursion and fall and the route53 svc-* zone, processes inside the NGOT network get the private DNS zone answers whilte querying FE dns resolvers

Managed assets#

  • 2 DNS zones bought to Gandi registrar (cloudservicesfactory.com, csfpriv.com)
  • 1 DNS zone per line (cloudservicesfactory.com, csfpriv.com) on route53
  • 1 DNS delegation per line on route servers for each zone bought via Gandi
  • one DNS zone and its delegation per contract zone (obs-.cloudservicesfactory.com, obs-.csfpriv.com) on route53
  • one DNS zone and its delegation per admin zone (admin-prd.cloudservicesfactory.com, admin-stg.csfpriv.com) on route53
  • one DNS zone and its delegation per line for loadbalancers public ips (svc.cloudservicesfactory.com, svc.csfpriv.com) on route53
  • one DNS zone without delegation per line for loadbalancers private ips (svc.cloudservicesfactory.com, svc.csfpriv.com) on FE DNSaaS