internal NTP: resolve boundary NTP sources from DNS in addition to being told explicitly #6050
Conversation
davepacheco
left a comment
davepacheco
left a comment
There was a problem hiding this comment.
One question not covered in the PR: have we ensured somehow that the internal DNS zones will have DNS configured in /etc/resolv.conf? Last I checked, that was not reliably configured. It was only available in some zones. But that was a while ago.
zone-setup/src/bin/zone-setup.rs
Outdated
| .expect("write to String is infallible"); | ||
| } | ||
| } else { | ||
| // TODO-john Replace with link to issue: remove specific boundary NTP |
There was a problem hiding this comment.
I assume you want to update this?
| } | ||
| writeln!( | ||
| &mut new_config, | ||
| "pool {boundary_pool} iburst maxdelay 0.1 maxsources 16", |
There was a problem hiding this comment.
note: I haven't reviewed the change in the chrony config
jgallagher
force-pushed
the
john/zone-setup-cleanup
branch
from
26413d8 to
3a57dfc
Compare
jgallagher
force-pushed
the
john/resolve-boundary-ntp-from-internal-dns
branch
2 times, most recently
from
bd2cd29 to
f973a52
Compare
jgallagher
force-pushed
the
john/resolve-boundary-ntp-from-internal-dns
branch
3 times, most recently
from
23c6b0e to
962da59
Compare
jgallagher
force-pushed
the
john/resolve-boundary-ntp-from-internal-dns
branch
from
962da59 to
1098aca
Compare
Yes, sled-agent does this here for internal DNS, confirmed on a4x2 and london. |
| (name, vec![DnsRecord::Aaaa(sled_ip)]) | ||
| }); | ||
|
|
||
| // Assemble the special boundary NTP name to support chrony on internal |
There was a problem hiding this comment.
Worth adding a unit test for this?
There was a problem hiding this comment.
I'm on the fence - the expanded test_blueprint_internal_dns_basic does check for this name. If you'd like a unit test specific to this crate, I can add one?
There was a problem hiding this comment.
I think it's worth it, mainly because I think it should just be 1-2 lines of code in test_builder_output() below (plus regenerate the expectorate file).
This is almost entirely planner work; no executor work was required, because it already supports "zones with external networking", and there's nothing special to boundary NTP beyond that from an execution point of view. I put this through a fairly thorough test on london; I'll put my notes from that in comments on the PR momentarily. This builds on #6050 and should be merged after it.
This PR adds a special internal DNS name
boundary.ntp.control-plane.oxide.internalwhich resolves to a set of AAAA records, one for each boundary NTP zone. We pass this name to chrony via apooldirective in its config file, allowing it to find the boundary NTP servers via internal DNS.Some context for this PR:
Fixes #4791.