DNS Framework: tenants cannot own DNS servers or vanity zones (no account/domainid on addDnsServer/createDnsZone)
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 35/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- java
研究方向
Start by reading the DNS Framework API definitions and permission checks for addDnsServer and createDnsZone, then trace how DNS server and zone ownership and public suffixes are handled. The issue proposes several alternative changes, including tenant ownership, domain admin access, and suffix rules, so first agree on scope with maintainers. Done means tenants can manage delegated vanity zones under the agreed ownership and access rules without receiving the PowerDNS API key.
由索引模型根據 Issue 內容生成。
描述
ISSUE TYPE
- Improvement Request / Bug Report
COMPONENT NAME
DNS Framework (PowerDNS provider), API, UI
CLOUDSTACK VERSION
4.23.0.0
SUMMARY
The new DNS Framework works well for provider-owned zones, but in a multi-tenant
cloud there is no way for a tenant to manage a zone for a domain they own
(e.g. customer.com). Every tenant zone is forced under the public server's
suffix, and the admin cannot create a server entry or zone on a tenant's behalf.
OBSERVED BEHAVIOUR
addDnsServercalled by a non-root account fails with
"This API can only be called by root admin".
The documentation states that admins and domain admins can create public
DNS servers, so either the docs or the permission check is wrong.- Only one DNS server entry per account + URL is allowed
("This Account already has a DNS server integration for URL: ..."). addDnsServerandcreateDnsZonehave noaccount,domainidor
projectidparameters (verified withlist apis ... filter=params),
so root cannot create a server entry or zone owned by a tenant.- Zones created by root are owned by root and are not visible to tenants.
- Tenants creating zones on a public server are always restricted to the
singlepublicdomainsuffix.
Result: a tenant who owns customer.com and delegates it to our nameservers
cannot manage that zone through CloudStack. The only workarounds are manual
management by root, a separate DNS UI outside CloudStack, or CNAMEs from the
vanity zone into a suffixed tenant zone.
USE CASE
- Provider runs a PowerDNS cluster and wants to offer managed DNS to tenants.
- Default: tenants self-serve zones under
cloud.provider.example
(works today). - Some tenants own their own domains (
customer.com), delegate them to the
provider's nameservers, and need to manage records (A, MX, TXT, CNAME)
and VM auto-registration for them, without access to the PowerDNS API key.
PROPOSED IMPROVEMENTS
- Add
account+domainid(andprojectid) toaddDnsServerand
createDnsZone, consistent with other CloudStack resource APIs, so root
can provision a server entry or zone owned by a tenant. - Alternatively, an API to change zone ownership
(e.g.assignDnsZone/updateDnsZone account=... domainid=...). - Allow domain admins to call
addDnsServeras documented, or update the
docs if root-only is intended. - Allow multiple allowed suffixes per public server, or per-domain suffix
rules (e.g. domainROOT/CustomerAmay createcustomer.com). - Optional: an ownership verification step (TXT challenge) before a tenant
can create a zone outside the public suffix, to prevent zone squatting.
STEPS TO REPRODUCE
- As root admin, add a public PowerDNS server with
publicdomainsuffix=cloud.provider.example. - As a tenant user, try to create zone
customer.com-> forced under the suffix. - As a tenant user or domain admin, try
addDnsServer-> "can only be called by root admin". - As root, try
addDnsServeragain with the same URL -> "already has a DNS server integration for URL". - As root, create zone
customer.com-> owned by root, not visible to the tenant.
- 主要語言
- Java
- 星號
- 3.1k
- 分支
- 1.4k
- 平均合併
- 7 天 16 小時
- 30 天內合併 PR
- 15
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
apache/cloudstack 的其他 Issue
-
resizeVolume of a running system VM's volume is accepted but the VM never sees the new size可能已有人在做 @bhouse-nexthop 於 4 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
apache/cloudstack#14645 · 1 則留言 ·
維護者通常 1 天內回覆
-
VR reports a load balancer change as applied when haproxy.cfg cannot be replaced可能已有人在做 @bhouse-nexthop 於 4 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 78/100
apache/cloudstack#14633 · 1 則留言 ·
維護者通常 1 天內回覆
-
restartNetwork reports a ResourceUnavailableException as an unexpected error (530), unlike restartVPC (534)可能已有人在做 @bhouse-nexthop 於 4 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 78/100
apache/cloudstack#14631 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
apache/cloudstack#14625 · 1 則留言 ·
維護者通常 1 天內回覆
-
Remote access VPN users are disconnected on every LB, ACL, port forward or firewall change (xl2tpd restarted on every iptables pass)可能已有人在做 @willbennett-devops 於 12 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
apache/cloudstack#14545 · 1 則留言 ·
維護者通常 1 天內回覆
查看 apache/cloudstack 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 75/100
ls1intum/thesis-management#1473 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 76/100
LunaDeerMC/Dominion#301 · 1 則留言 ·
-
[FEATURE] Expose external refresh, node-level translog and warmer stats可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉untriaged
難度 2/5 1-3 小時 新手友好度 68/100
opensearch-project/opensearch-prometheus-exporter#680 ·
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100
-
難度 2/5 1-3 小時 新手友好度 66/100
維護者通常 2 天內回覆