Automate Bind configuration fully with Ansible and Netbox-DNS

[Stathogon]

Hello,
I am planning to automate the entire Bind Server installation and configuration. Therefore I plan to follow the following steps:

1. new VMs get a (optional) new field with the function to define possible Ansible configurations. (In this case e.g. Bind-Master and Minion).
2. Ansible evaluates these fields and builds an inventory from them.
3. Ansible checks a specific DNS zone to see if a DNS entry with an A record for the server address exists, if not, it is created.
4. a new name server record is created with this DNS record
5. this name server is added for all zones in the netbox
6. installation of the server and bind configuration is carried out with Ansible

Points 1, 2 and 6 are already implemented (points 3-5 are currently being done manually).

Now I have a few questions along the way:

1. is there a simple way to create DNS records with Ansible?
2. at the moment I have a DNS record for the administration and a DNS record for the nameserver entries, which are for better readability. Does this make sense or should I only use one DNS record (in the style of dns.example.com. Management entry is more in the style of 01-bind-01.mgmt.example.com)?
3. should I simply use IP addresses in the name server, which would save me the 3rd point?
4. can I create nameserver entry with Ansible? (I think so, since this is possible via the API, but I can't find a netbox module, that has that feature)

[peteeckel]

Your approach looks sensible to me.

In fact I am doing something similar: I create the configuration files for BIND primary and secondary servers using Ansible with data from NetBox DNS (Views and Zones) and some external data as well, and then dump the zones for each view to zone files using a fairly simple Ansible template file.

Another approach would be to make all of your zones dyamic and update records using community.general.nsupdate. I briefly considered this but chose not to go down that path because I generally prefer my zones to be static where possible.

I would stick to the duplicate address records for nameservers for two reasons: The one you mentioned, readability (and less leakage of internal information to external entities), and flexibility so you don't have to change internal processes like provisioning if the architecture of your DNS infrastructure changes (and vice versa).

What exactly are you meaning with your third question? RFC1035, Section 3.3.11 clearly states that an NS record must have a domain name as its RDATA value, so that's probably not what you have in mind.

The NetBox Ansible collection unfortunately only has modules for the core models. Creating a collection for NetBox DNS has been on my list for quite a while, but as it is other projects (the ones I get paid for :-)) take up most of my time, so that's been postponed for what feels like forever. The priority has not been very high from the start, as most of the users I know of use the Ansible/NetBox combo in the other direction - define things in NetBox and then make them real using Ansible. There are, however, some use cases where it makes sense to add records etc. to NetBox from an Ansible automation playbook, so it's pretty sure to materialise at some point (by the way, nothing keeps you from starting such a project - fame and honour will ensue :-)).

[Stathogon]

Thanks for the fast reply, so all in all im on a good way.
Regarding my third question, thats probably why im not doing it that way :D
Creating a Ansible module is at the moment way out of my league.
Maybe i go with a direct api call or make use of netbox scripts to setup the Netbox side.

[ThomasADavis]

You could also octodns with the netbox plugin. There are two different plugins

https://github.com/sukiyaki/octodns-netbox is just a source to push into dns servers..

https://github.com/jcollie/octodns-netbox-dns - can do both directions, pull from the dns servers into netbox, or push from netbox into the dns servers. note - there is a fork at https://github.com/olofvndrhr/octodns-netbox-dns with more fixes.

We used the 2nd to pull in 100% the dns server, cleaned it up in netbox, and then pushed it back out. Run a cron job that just syncs every once in a while..

I also have posted in the pass, a Ansible rest api role to update the netbox dns plugin..