Veritas InfoScale™ for Kubernetes Environments 8.0.220 - Linux

Applicable only to Secure Linux DNS.

1. Following steps are the prerequisites for SampleDNS.yaml. DNS private key and DNS key must be added to infoscale-dns-secret.

   • Run the following command on the bastion node

     cat dns.private | base64

     Copy and remove all unnecessary spaces from the <dns private key> that is displayed.

   • Run the following command on the bastion node

     cat dns.key | base64

     Copy and remove all unnecessary spaces from the <dns key> that is displayed.

   • Run the following command on the bastion node to generate the keys

     oc get secret -n infoscale-vtas |grep infoscale-sds-dns-secret

     Use the output in the following command.

   • Run the following command on the bastion node and add the keys

     oc edit secret <output for infoscale-sds-dns-secret> -n infoscale-vtas

     apiVersion: v1
     data:
     	dns.private: <dns private key>
     	dns.key: <dns key>
     kind: Secret
     

     Note:

     You can add the data: section if it is not present in the file.

   • Save and close the file.

   • Run the following command to verify whether addition of keys is successful

     oc get secret infoscale-dns-secret -n infoscale-vtas -o json

     Review the output as under

     {
         "apiVersion": "v1",
         "data": {
             "dns.key": "<dns key>",
             "dns.private": "<dns private key>"
         },
         "kind": "Secret",
     .
     .
     .
     .
     
     

   • The private key files are created in /etc/vx/dns-certs/ . You can run the following command on any of the InfoScale pods.

     ls -l /etc/vx/dns-certs/dns.*

     Review the output as under

     lrwxrwxrwx. 1 root root 18 Oct 18 05:10 /etc/vx/dns-certs/dns.key
                                                     -> ..data/dns.key
     lrwxrwxrwx. 1 root root 18 Oct 18 05:10 /etc/vx/dns-certs/dns.private 
                                                   -> ..data/dns.private
     
     

2. Edit /YAML/DR/SampleDNS.yaml as under

   apiVersion: infoscale.veritas.com/v1
   kind: DNS
   metadata:
     name: <Add 'Name of DNS' here>
   spec:
     # Domain name for the DNS
     domain: "<Add 'example.com' here>"
     # (optional) Path for the file containing private TSIG key, 
     # required for secure DNS updates.
     # Configure only for UNIX based DNS server
     tsigKeyFile: "/<Add '/etc/vx/dns-certs/dns.private' here>"
     # (optional) The list of primary master name servers in
     # the domain.
     stealthMasters: ["1.2.3.4"]
     # (optional) An association of DNS resource record value
     # Specify the key values in map format
     resRecord: 
           "r7515-054-vm8" : "10.221.85.81"
           "r7515-054-vm9" : "10.221.85.82" 
           "r7515-054-vm10" : "10.221.85.83" 
           "www" : "r7515-054-vm8" 
           "abc" : "r7515-054-vm9"
           "xyz" : "r7515-054-vm10"
     # (optional) Time to Live value, in seconds for DNS entries 
     # in the zone
     # default value is 86400 
     #ttl: 86400
   
     # (optional) Time in seconds after which DNS agent
     # attempts to refresh resrecords on DNS server
     #refreshInterval: 0
     
     # (optional)  Set to "true" if the DNS server that you have 
     # configured is a Windows DNS server and only if it accepts 
     # secure dynamic updates default is false
     #useGSSAPI: false
   
     # (optional) Set to "true" if you want to clean up all 
     # the existing DNS records for the configured keys before 
     # adding new records default is false
     #cleanRRKeys: false
     
     # (optional) Set to "true" if DNS online should create 
     # PTR records for each RR of type A or AAAA
     # default is false
     #createPTR: false
   
     # (optional) Set to "true" if if DNS offline should 
     # remove all records defined by ResRecord
     # default is false
     #offDelRR: false
   

   Note:

   name and domain are mandatory here. Update tsigKeyFile for secure DNS only.

3. Run the following command on the bastion node

   oc apply -f /YAML/DR/SampleDNS.yaml

4. To verify whether DNS resource is created successfully, run the following command on the bastion node

   oc -n infoscale-vtas get dns.infoscale.veritas.com/Name of DNS

5. Review output similar to the following

   NAME        DOMAIN        STATE
   Name of DNS example.com   INIT
   

   Note:

   You must create a DNS resource with its attributes on each member cluster as DNS CR is not synchronized across peer clusters.