DNS: from manual records to a modern & dynamic approach

Van Hau TRAN
Product Owner #Domain
DNS: from manual records to a modern &
dynamic approach
Emplacement photo
2

"Everything is a freaking DNS problem"
3
DNS_PROBE_FINISHED_NXDOMAIN

Index
Why need to change?
4

Index
Why need to change?
What we need?
5

Agenda
Why change?
What do we need?
Scaleway Domains under the hood
6

A long time ago
Internet's phonebook
7

A long time ago
BIND
Berkeley Internet Name Domain
Authoritative and Resolver
Working with zone ﬁles
8

A brand new world
Evolutions
• Dedicated
• Cloud
• On-premises
• Hybrid Cloud
• Multi Cloud
• VMs
• Containers
9

Scaleway Domains
European cloud computing company
Need a DNS product:
• To connect to Scaleway products
• To allow connection from/to any external
services
11

Devops Culture
• Continuous Anything needs:
• Infrastructure Automation
• Continuous Delivery
INFRA AS CODE
13

Devops Culture
• Continuous Anything needs:
• Infrastructure Automation
• Continuous Delivery
INFRA AS CODE
14

Infra as Code
Curl
15
curl --request PATCH
--url https://api.scaleway.com/domain/v2alpha2/dns-zones/scaleway-demo.fr/records
--header 'content-type: application/json'
--header 'x-auth-token: xxxx'
--data '{
    "return_all_records": true,
    "changes": [
        {
            "clear": {}
        },
        {
            "add": {
                "records": [
                    {
                        "name": "www",
                        "data": "1.2.3.4",
                        "type": "A",
                        "ttl": 10
                    }
                ]
            }
        }
    ]
}'

Infra as Code
{
"add": {
"records": [
{
"name": "www",
"data": "1.2.3.4",
"type": "A",
"ttl": 10
}
]
}
}
Curl
16

Infra as Code
Ansible
- name: define A records
domain_scaleway_record:
token: "{{ token }}"
endpoint: "{{ endpoint | default('') }}"
name: "{{ item['name'] }}"
zone: "{{ zone }}"
type: "{{ item['type'] }}"
content : "{{ item['content'] }}"
ttl: "{{ item['ttl'] }}"
state: "{{ item['state'] }}"
with_items: '{{ records }}'
register: result
17

How we run some of our tests
18

Static vs Dynamic
STATIC ANSWER
19
www resolve to 1.2.3.4

Static vs Dynamic
STATIC ANSWER DYNAMIC ANSWER
20

Static vs Dynamic
record A
1.2.3.4
record A
1.2.3.4 if FR
else 4.3.2.1
21

Static vs Dynamic
22

Scaleway Domains API
BASIC VERSION 24
API GW DNS API
DOMAIN API

BASIC VERSION 25
API GW DNS API
DOMAIN API
DNS SERVER
REGISTRAR

BASIC VERSION 26
API GW DNS API
DOMAIN API
DNS SERVER
DNS Queries
REGISTRAR

BASIC VERSION 27
API GW DNS API DNS SERVER
DNS Queries

Scaleway Domains API - Basic Version
PowerDNS
• Don't reinvent the wheel
• RFC compliant
• API
• + Dynamic record LUA
example :
ifurlup('http://www', {'51.15.121.80','51.15.210.104'}, {stringmatch='works'}
28

POWERDNS LUA 29
DNS SERVER
DNS Queries
engine

POWERDNS LUA 30
DNS SERVER
DNS Queries
engine
record LUA
script
function
external call

Example
31
web1 web2
resolve www.scaleday-test.fr
DNS SERVER
don't use if down

POWERDNS 32
record LUA
script
function
external call check if http://51.15.121.80
contains the word "works"
extract script for WWW
use "ifurlup" function
check http://51.15.210.104
contains the word "works"
ifurlup( 'http://www', {'51.15.121.80','51.15.210.104'},{stringmatch='works'})

curl --request PATCH
--url https://api.scaleway.com/domain/v2alpha2/dns-zones/scaleway-demo.fr/records
--header 'content-type: application/json'
--header 'x-auth-token: xxxxxxxxxxxxxxxxxx'
--data '{
    "return_all_records": false,
    "changes": [
        {
            "clear": {}
        },
        {
            "add": {
                "records": [
                    {
                        "name": "www",
                        "data": "url http://www.scaleway-demo.fr ips 51.15.121.80,51.15.210.104 text '''works'''" ,
                        "type": "FUNC_URLUP_A",
                        "ttl": 60
                    }
                ]
            }
        }
    ]
}'
Curl using our API
33

"name": "www",
"data": "url http://www.scaleway-demo.fr
ips 51.15.121.80,51.15.210.104
text '''works'''",
34
Curl using our API

"name": "www",
"data": "url http://www.scaleway-demo.fr
ips 51.15.121.80,51.15.210.104
text '''works'''",
35
name of record
url to ask
IPs to check
text to check
custom type
Curl using our API

DEMO
36
when www.scaleway-demo.fr record is set to
url http://www.scaleway-demo.fr ips 51.15.121.80,51.15.210.104 text 'works'
with previous curl
dig A www.scaleway-demo.fr @9.9.9.9 +short will answer randomly
to 51.15.121.80 or 51.15.210.104
if we update the text of the page to simulate a server down on 51.15.210.104
ssh root@51.15.210.104 "sed -i 's/works/fails/g' /var/www/html/index.html"
all dig will always answer 51.15.121.80

PowerDNS LUA experience
Works ﬁne but:
• limited list of functions
• only accepting IP
• -> limited rules
Scaling / performance:
• run on same server
• limited control / monitoring
• only works for PowerDNS
37

PowerDNS LUA experience
• BIND
• KNOT
• COREDNS
• ...
others software
Works ﬁne but:
• limited list of functions
• only accepting IP
• -> limited rules
Scaling / performance:
• run on same server
• limited control / monitoring
• only works for PowerDNS
38

I want more
39

Scaleway Domains API - Intermediate Version
Need to be agnostic
40

INTERMEDIATE VERSION
41
DNS API
DNS SERVER
STATIC
DNS Queries
RESOLVE
DYNAMIC?backend
driver
1
2

42
DNS API
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMICbackend
driver
?
1
2

43
DNS API
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
backend
driver
DNS SERVER
DYNAMIC
scaling
?
1
2

44
DNS API
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
backend
driver
DNS SERVER
DYNAMIC
A/B Testing
?
1
2

45
DNS API
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMICbackend
driver
?
1
2

Forward requests to DNS server running dynamic records
46
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
USING ALIAS RECORD
IPv4 for www ?

47
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
USING ALIAS RECORD
IPv4 for www ?

48
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
USING ALIAS RECORD
IPv4 for www is 1.2.3.4

ALIAS can almost work but
• custom record type
• not working with wildcards
49

50
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
USING ZONE DELEGATION
IPv4 for www ?

51
DNS SERVER
STATIC
DNS Queries
please ask this DNS
DNS SERVER
DYNAMIC

52
DNS SERVER
STATIC
DNS Queries
DNS SERVER
DYNAMIC
IPv4 for www ?

Delegation zone with NS record:
• mechanism for failover, load balancing
• allows working with wildcards
53

54
DNS API
DNS SERVER
STATIC
DNS Queries
backend
1 2
DNS SERVER
DYNAMIC
3
driver
zone delegation

55
DNS API
DNS SERVER
STATIC
DNS Queries
backend
1 2
zone delegation DNS SERVER
DYNAMIC
1
not every request !!!
driver

56
DNS API
DNS SERVER
STATIC
DNS Queries
backend
1 2
DYNAMIC
3
engine
driver

LUA engine can work but:
• not everybody knows LUA
• engine to code, scale and maintain
Engine for dynamic records
57

Microservices engine:
• DNS over HTTPS JSON
• all langages
• external engine
Engine for dynamic records
58

DNS answer in JSON
59
{
   "Status":0,
   "TC":false,
   "RD":true,
   "RA":true,
   "AD":true,
   "CD":false,
   "Question":[
      {
         "name":"www.scaleday-test.fr.",
         "type":1
      }
   ],
   "Answer":[
      {
         "type":1,
         "TTL":60,
         "data":"51.158.125.207"
      }
   ]
}

DNS answer in JSON
60
   "Answer":[
      {
         "type":1,
         "TTL":60,
         "data":"51.158.125.207"
      }

61
DNS API
DNS SERVER
STATIC
DNS Queries
backend
driver
1 2
DYNAMIC
3
engine
resolve service
4

62
DNS API
DNS SERVER
STATIC
DNS Queries
backend
driver
1 2
DYNAMIC
3
engine
external resolve service
4

Demo - Mix Static & Dynamic
63
Domain: scaleway-test.fr
www.
time.
*.dyn.
static record A 1.2.3.4
dynamic record TXT return time
dynamic record A/AAAA return IPs
from external source

64
*.dyn.
IPs of instances tagged

65
DNS SERVER
DYNAMIC
engine
external resolve service
Serverless
Instances
DNS over HTTPS
API

Declaration is easy
66
{
"name": "*.dyn",
"data": "https://bdc5d5cc-ccc3-402a-b642-c59d4d87a487-
scalewaypython3deveratzbfk.functions.fnc.fr-par.scw.cloud/resolve",
"type": "FUNCTION",
"ttl": 10
}

LIVE DEMO
67

Next challenges
Offer sample dynamics records
DNSSEC with dynamics records
Manage timeout, cache, warmup
Performance
etc ..
68

Early Access open
We need you
69
https://scaleway.com/betas/

Source
70
vanonox

THANK YOU
Stay tuned for exclusive how-to's and updates, follow us
on Twitter and LinkedIn @Scaleway
Emplacement QR Code
71
https://scaleway.com/betas/

DNS: from manual records to a modern & dynamic approach

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to DNS: from manual records to a modern & dynamic approach

Similar to DNS: from manual records to a modern & dynamic approach (20)

More from Scaleway

More from Scaleway (20)

Recently uploaded

Recently uploaded (20)

DNS: from manual records to a modern & dynamic approach