DNS Framework: tenants cannot own DNS servers or vanity zones (no account/domainid on addDnsServer/createDnsZone)

Đang mở
  • Có gì không ổn?
#14,525 5 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
35/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
java
Lĩnh vực
backend-api-design

Hướng nghiên cứu

Start by reading the DNS Framework API definitions and permission checks for addDnsServer and createDnsZone, then trace how DNS server and zone ownership and public suffixes are handled. The issue proposes several alternative changes, including tenant ownership, domain admin access, and suffix rules, so first agree on scope with maintainers. Done means tenants can manage delegated vanity zones under the agreed ownership and access rules without receiving the PowerDNS API key.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

ISSUE TYPE
  • Improvement Request / Bug Report
COMPONENT NAME

DNS Framework (PowerDNS provider), API, UI

CLOUDSTACK VERSION

4.23.0.0

SUMMARY

The new DNS Framework works well for provider-owned zones, but in a multi-tenant
cloud there is no way for a tenant to manage a zone for a domain they own
(e.g. customer.com). Every tenant zone is forced under the public server's
suffix, and the admin cannot create a server entry or zone on a tenant's behalf.

OBSERVED BEHAVIOUR
  1. addDnsServer called by a non-root account fails with
    "This API can only be called by root admin".
    The documentation states that admins and domain admins can create public
    DNS servers, so either the docs or the permission check is wrong.
  2. Only one DNS server entry per account + URL is allowed
    ("This Account already has a DNS server integration for URL: ...").
  3. addDnsServer and createDnsZone have no account, domainid or
    projectid parameters (verified with list apis ... filter=params),
    so root cannot create a server entry or zone owned by a tenant.
  4. Zones created by root are owned by root and are not visible to tenants.
  5. Tenants creating zones on a public server are always restricted to the
    single publicdomainsuffix.

Result: a tenant who owns customer.com and delegates it to our nameservers
cannot manage that zone through CloudStack. The only workarounds are manual
management by root, a separate DNS UI outside CloudStack, or CNAMEs from the
vanity zone into a suffixed tenant zone.

USE CASE
  • Provider runs a PowerDNS cluster and wants to offer managed DNS to tenants.
  • Default: tenants self-serve zones under cloud.provider.example
    (works today).
  • Some tenants own their own domains (customer.com), delegate them to the
    provider's nameservers, and need to manage records (A, MX, TXT, CNAME)
    and VM auto-registration for them, without access to the PowerDNS API key.
PROPOSED IMPROVEMENTS
  1. Add account + domainid (and projectid) to addDnsServer and
    createDnsZone, consistent with other CloudStack resource APIs, so root
    can provision a server entry or zone owned by a tenant.
  2. Alternatively, an API to change zone ownership
    (e.g. assignDnsZone / updateDnsZone account=... domainid=...).
  3. Allow domain admins to call addDnsServer as documented, or update the
    docs if root-only is intended.
  4. Allow multiple allowed suffixes per public server, or per-domain suffix
    rules (e.g. domain ROOT/CustomerA may create customer.com).
  5. Optional: an ownership verification step (TXT challenge) before a tenant
    can create a zone outside the public suffix, to prevent zone squatting.
STEPS TO REPRODUCE
  1. As root admin, add a public PowerDNS server with publicdomainsuffix=cloud.provider.example.
  2. As a tenant user, try to create zone customer.com -> forced under the suffix.
  3. As a tenant user or domain admin, try addDnsServer -> "can only be called by root admin".
  4. As root, try addDnsServer again with the same URL -> "already has a DNS server integration for URL".
  5. As root, create zone customer.com -> owned by root, not visible to the tenant.
Ngôn ngữ chính
Java
Star
3.1k
Fork
1.4k
Merge trung bình
7 ngày 16 giờ
Pull request đã merge (30 ngày)
15

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của apache/cloudstack

Tất cả issue của apache/cloudstack

Issue tương tự

Thêm issue về Java

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.