DNS and keepalived

[Leroy Tennison]

As previously posted, I just added a slave of a master for disaster recovery and now need to know how to promote it should the master be offline too long. An additional complicating factor is that the master and slave exist on a failover pair managed by keepalived. My web search has found a few references to this situation but they have either used slave servers or were veery light on the details of bind configuration. I'm converting and existing situation where there was a single server for almost totally non-DHCP clients (servers). I would prefer to not roll out a different DNS resolver configuration to all those non-DHCP clients - the environment size is sort of "in between" (not small or large).

The issues I see are in the SOA, with keepalived I could leave the SOA the same on both since the IP address for the DNS server (and other functions) moves. The question is "Am I missing something?" which will come back to haunt me later?


Join us
at the 2018 Momentum User Conference!
Register
here
Leroy Tennison
Network Information/Cyber Security Specialist
E: le...@datavoiceint.com
2220 Bush Dr
McKinney, Texas
75070
www.datavoiceint.com
TThis message has been sent on behalf
of a company that is part of the Harris Operating Group of
Constellation Software Inc. These companies are listed
here
.
If you prefer not to be contacted by Harris
Operating Group
please notify us
.
This message is intended exclusively for the
individual or entity to which it is addressed. This communication
may contain information that is proprietary, privileged or
confidential or otherwise legally exempt from disclosure. If you are
not the named addressee, you are not authorized to read, print,
retain, copy or disseminate this message or any part of it. If you
have received this message in error, please notify the sender
immediately by e-mail and delete all copies of the
message.

[Grant Taylor]

On 08/06/2018 08:14 AM, Leroy Tennison wrote:
> As previously posted, I just added a slave of a master for disaster
> recovery and now need to know how to promote it should the master be
> offline too long.

Please see the reply that I just sent for details about how I handled
this problem in the past.

> An additional complicating factor is that the master and slave exist on
> a failover pair managed by keepalived.

Okay. My opinion is that keepalived should be used between two
identical servers. Thus between two masters or two slaves. I would not
want to try to cross the role between two servers managed by keepalived.

> My web search has found a few references to this situation but they have
> either used slave servers or were veery light on the details of bind
> configuration.

I've not dealt with keepalived in a long time, so I can't say for sure.
But I believe that most of the configurations I've seen work between two
slaves that share a common (optionally hidden) master server. This
allows both servers to be identical and a backup for each other and
avoids the need for keepalived to significantly reconfigure BIND's
operation.

> I'm converting and existing situation where there was a single server for
> almost totally non-DHCP clients (servers).

Okay.

> I would prefer to not roll out a different DNS resolver configuration to
> all those non-DHCP clients

I do not see any reason to change the client configuration.

Ideally the DNS server's VIP / functional IP will stay the same. Thus
no need to reconfigure clients.

The change will be in the servers that are capable of hosting said VIP.

Aside from potential SOA / MNAME issues (see my other reply) I don't see
any issues in adding additional servers; 1 (optionally hidden) master
and an additional slave to participate in the keepalived configuration
with the existing server.

> the environment size is sort of "in between" (not small or large).

The environment size is immaterial to the BIND configuration. (It may
be applicable to you for motivation to doing things.)

> The issues I see are in the SOA, with keepalived I could leave the SOA
> the same on both since the IP address for the DNS server (and other
> functions) moves.

I don't think the SOA / MNAME actually need to be the same. They just
need to be accessible. (See my other reply.)

> The question is "Am I missing something?" which will come back to haunt
> me later?

It's hard to say. I don't see anything obvious jumping out at me.



--
Grant. . . .
unix || die