Designate DNS as a Service in OpenStack

5 min readDec 29, 2023

Overview Designate

Designate is an Open Source DNS-as-a-Service implementation and a part of the OpenStack ecosystem of services for running clouds. It allows users and operators to manage DNS records, names and zones via a REST API and can configure existing DNS name servers to contain those records. Designate can also be configured by an operator to integrate with both the OpenStack Network Service (Neutron) and the Compute Service (Nova) so that records are automatically created when floating IPs and compute instances are created respectively, and uses the OpenStack Identity Service (Keystone) for user management. Designate can be thought of as similar to AWS Route 53.

Designate provides DNSaaS services for OpenStack:

REST API for domain/record management
Multi-tenant
Integrated with Keystone for authentication
Framework in place to integrate with Nova and Neutron notifications (for auto-generated records)
Support for Bind9 and Infoblox out of the box

Designate Architecture

Designate is comprised of several different services: the API, Producer, Central, Worker and Mini DNS. It uses an oslo.db compatible database to store state and data, and an oslo.messaging compatible message queue to facilitate communication between services. Multiple copies of all Designate services can be run in tandem to facilitate high availability deployments, with the API process often sitting behind load balancers.

More about designate: https://docs.openstack.org/designate/latest/intro/index.html

Prerequisites:

OpenStack Environment Installed,
Look here for OpenStack Deployment reference Deploy Multinode OpenStack
Interface used bydns_interface must be reachable from public network

Setup Designate on Kolla deployment:

Let’s take a look at the steps required to configure designate on Kolla deployment. The steps look something like the following:

1. Configuration designate service

Enable and configure designate service in /etc/kolla/globals.yml

...
enable_designate: "yes"
dns_interface: "ens8"
designate_ns_record:
  - "ns1.sample.kinton.org"
designate_backend: "bind9"

Designate MDNS node requires interface ens8 to be reachable from public network.

2. Install required python clients

pip3 install python-openstackclient python-designateclient

3. Enable designate service

Ensure the environment is ready with prechecks process.
Then start deploy to enable designate

### Do pre-deployment checks for hosts
kolla-ansible -i multinode prechecks

### Finally proceed to deploy 
kolla-ansible -i multinode deploy

Check designate service was already enabled

openstack service list; openstack endpoint list --service designate

4. Neutron and Nova Integration

Create default designate Zone, in this case is sample.kinton.org.

openstack zone create --email admin@sample.kinton.org sample.kinton.org.
openstack zone list
+--------------------------------------+--------------------+---------+------------+--------+--------+
| id                                   | name               | type    |     serial | status | action |
+--------------------------------------+--------------------+---------+------------+--------+--------+
| d11f8186-a09c-4ef6-90d7-d5c1a709fa71 | sample.kinton.org. | PRIMARY | 1703834168 | ACTIVE | NONE   |
+--------------------------------------+--------------------+---------+------------+--------+--------+

openstack recordset list sample.kinton.org.

Create designate-sink custom configuration folder

mkdir -p /etc/kolla/config/designate/

Append designate ZONE_ID in /etc/kolla/config/designate/designate-sink.conf

zone_id must be manually filled an ID from openstack zone list, check in file kolla-ansible/ansible/roles/designate/templates/designate.conf.j2

### cat /etc/kolla/config/designate/designate-sink.conf
[handler:nova_fixed]
zone_id = d11f8186-a09c-4ef6-90d7-d5c1a709fa71
[handler:neutron_floatingip]
zone_id = d11f8186-a09c-4ef6-90d7-d5c1a709fa71

Reconfigure Designate:

kolla-ansible -i multinode reconfigure --tags designate,neutron,nova

5. Verify operation

List available networks and then associate withdns domain

### List available network
openstack network list

### Associate a domain to a network
openstack network set <NETWORK_ID> --dns-domain sample.kinton.org.

Check detail of network, change <NETWORK_ID> with actual value

openstack network show <NETWORK_ID> --fit

Create a new instance

openstack server create \
  --image cirros \
  --flavor m1.tiny \
  --key-name mykey \
  --nic net-id=<NETWORK_ID> \
  vm-cirros
openstack server list

Check DNS records in Designate

openstack recordset list sample.kinton.org.
+--------------------------------------+------------------------------------+------+-------------------------------------------+--------+--------+
| id                                   | name                               | type | records                                   | status | action |
+--------------------------------------+------------------------------------+------+-------------------------------------------+--------+--------+
| ceec5fb2-5ffe-4b4c-b42b-94e1424a94ca | sample.kinton.org.                 | NS   | ns1.sample.kinton.org.                    | ACTIVE | NONE   |
| eb1cf5f2-edf4-475c-9fa4-0c23b263ea3e | sample.kinton.org.                 | SOA  | ns1.sample.kinton.org.                    | ACTIVE | NONE   |
|                                      |                                    |      | admin.sample.kinton.org. 1703838070 3558  |        |        |
|                                      |                                    |      | 600 86400 3600                            |        |        |
| 5e1b92ab-450c-4fb2-a690-0d5ce6dd040b | vm-cirros.admin.sample.kinton.org. | A    | 10.8.60.83                                | ACTIVE | NONE   |
| b4787cce-70aa-4cd5-9e17-3959b7d2e666 | vm-cirros.sample.kinton.org.       | A    | 10.8.60.83                                | ACTIVE | NONE   |
| ec9cad6d-01e2-40e1-9979-cfc041b1692e | 10-8-60-83.sample.kinton.org.      | A    | 10.8.60.83                                | ACTIVE | NONE   |
+--------------------------------------+------------------------------------+------+-------------------------------------------+--------+--------+

Query instance DNS information to Designate dns_interface IP address. Validate that designate resolves the DNS record.

dig +short @<DNS_INTERFACE_IP> vm-cirros.sample.kinton.org. A

more information about how designate works, see Designate, a DNSaaS component for OpenStack.

See other content

References :