convert dnsmasq to serve dns only

Author: mfencik

components/ironic/dnsmasq-cm.yaml

@@ -3,19 +3,11 @@ kind: ConfigMap
 metadata:
   name: ironic-dnsmasq
 data:
-  # interface to listen on the host
-  PROVISIONER_INTERFACE: "eth0"
-  # common separated list of DHCP tagged configs
-  DHCP_TAGS: tag1
-  # When defining the IP address range, make sure to include subnet
-  # information, especially for the pools serving relayed requests
-  DHCP_RANGE_TAG1: 192.168.200.4,192.168.200.12,255.255.255.0,192.168.200.255,30m
-  DHCP_OPTION_TAG1_ROUTER: 192.168.200.1
   # external IP address of Ingress. Used to populate DNS A records for the
   # Understack components
   INGRESS_IP: 192.168.1.177
+  # DNS zone suffix for wildcard A record pointing to INGRESS_IP
+  DNS_ZONE: understack.local
   DNS_PORT: '53'
-  LOG_DNS_QUERIES: 'true'
-  LOG_DHCP_QUERIES: 'true'
   # If you want to print rendered dnsmasq.conf in the logs
   # DEBUG_DNSMASQ_CONF: "yes"

components/ironic/dnsmasq-ss.yaml components/ironic/dnsmasq-deploy.yamlcomponents/ironic/dnsmasq-ss.yaml renamed to components/ironic/dnsmasq-deploy.yaml

@@ -10,20 +10,16 @@ spec:
   - name: dns
     port: 53
     protocol: UDP
-  - name: dhcp
-    port: 67
-    protocol: UDP
   clusterIP: None
   selector:
     application: ironic-dnsmasq
 ---
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
   name: ironic-dnsmasq
   namespace: openstack
 spec:
-  serviceName: ironic-dnsmasq
   replicas: 1
   selector:
     matchLabels:
@@ -33,8 +29,6 @@ spec:
       labels:
         application: ironic-dnsmasq
     spec:
-      nodeSelector:
-        dhcp_role: server
       hostNetwork: true
       containers:
         - name: dnsmasq
@@ -43,8 +37,7 @@ spec:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             capabilities:
-              # needed for privileged ports and to send ICMP packets
-              add: ["NET_ADMIN", "NET_RAW"]
+              add: ["NET_BIND_SERVICE"]
           args:
             - /usr/sbin/dnsmasq
             - '--no-daemon'
@@ -56,25 +49,13 @@ spec:
             - name: dns
               containerPort: 53
               protocol: UDP
-            - name: dhcp
-              containerPort: 67
-              protocol: UDP
-            - name: tftp
-              containerPort: 69
-              protocol: UDP
           volumeMounts:
             - name: pod-tmp
               mountPath: /tmp
             - name: pod-dnsmasq-d
               mountPath: /etc/dnsmasq.d
-            - name: pod-dhcp
-              mountPath: /var/lib/misc
       volumes:
         - name: pod-tmp
           emptyDir: {}
         - name: pod-dnsmasq-d
-          persistentVolumeClaim:
-            claimName: dnsmasq-ironic
-        - name: pod-dhcp
-          persistentVolumeClaim:
-            claimName: dnsmasq-dhcp
+          emptyDir: {}

components/ironic/dnsmasq-pvc.yaml

@@ -5,8 +5,8 @@ kind: Kustomization
 resources:
   - ironic-mariadb-db.yaml
   - ironic-rabbitmq-queue.yaml
-  - dnsmasq-pvc.yaml
-#  - dnsmasq-ss.yaml
+  - dnsmasq-cm.yaml
+  - dnsmasq-deploy.yaml
   - ironic-ks-user-baremetal.yaml
     # less than ideal addition but necessary so that we can have the ironic.conf.d loading
     # working due to the way the chart hardcodes the config-file parameter which then

components/ironic/kustomization.yaml

@@ -242,22 +242,12 @@ pod:
     ironic_conductor:
       ironic_conductor:
         volumeMounts:
-          - name: dnsmasq-ironic
-            mountPath: /etc/dnsmasq.d/
-          - name: dnsmasq-dhcp
-            mountPath: /var/lib/dnsmasq/
           - name: device-types
             mountPath: /var/lib/understack/device-types
           - name: ironic-inspection-rules
             mountPath: /etc/ironic/inspection-rules/
             readOnly: true
         volumes:
-          - name: dnsmasq-ironic
-            persistentVolumeClaim:
-              claimName: dnsmasq-ironic
-          - name: dnsmasq-dhcp
-            persistentVolumeClaim:
-              claimName: dnsmasq-dhcp
           - name: device-types
             configMap:
               name: device-types

components/ironic/values.yaml

@@ -1,55 +1,12 @@
 # syntax=docker/dockerfile:1
-FROM debian:bookworm-20240408-slim AS builder
+FROM debian:forky-slim AS prod
 
-ENV DEBFULLNAME="Marek Skrobacki"
-ENV DEBEMAIL="marek.skrobacki@rackspace.co.uk"
-ENV QUILT_PATCHES=debian/patches
-
-RUN echo "deb-src http://deb.debian.org/debian bookworm main" > /etc/apt/sources.list
-RUN apt-get update && apt-get -y install \
-    build-essential \
-    devscripts \
-    fakeroot \
-    debhelper \
-    automake \
-    autotools-dev \
-    pkg-config \
-    ca-certificates \
-    quilt \
-    ipxe \
-    --no-install-recommends
-WORKDIR /src
-RUN apt-get -y build-dep dnsmasq
-RUN apt-get -y source dnsmasq
-# copy in our patch
-COPY containers/dnsmasq/dnsmasq/dhcp-allowed-srvids.patch /src/
-# setup the patch to be built into the quilt file
-# set our version number to a local override suffixed by '.uc1'
-RUN cd /src/dnsmasq-* && \
-    mkdir -p debian/patches && \
-    mv /src/dhcp-allowed-srvids.patch debian/patches && \
-    dch -l .uc "patched for dhcp-allowed-srvids" && \
-    echo dhcp-allowed-srvids.patch >> debian/patches/series && \
-    quilt push -a
-# build it
-RUN cd /src/dnsmasq-* && dpkg-buildpackage -rfakeroot
-
-
-FROM debian:bookworm-20240408-slim AS prod
-
-LABEL org.opencontainers.image.description="dnsmasq for Understack's Ironic"
-
-COPY --from=builder /src/dnsmasq-base_*_amd64.deb /tmp
-COPY --from=builder /src/dnsmasq_*_all.deb /tmp
+LABEL org.opencontainers.image.description="dnsmasq DNS-only for Understack"
 
 RUN apt-get update && \
-    apt-get -y install --no-install-recommends python3-jinja2 ipxe && \
-    apt-get -y --fix-broken install --no-install-recommends /tmp/dnsmasq-base_*_amd64.deb /tmp/dnsmasq_*_all.deb && \
+    apt-get -y install --no-install-recommends dnsmasq-base python3-jinja2 && \
     apt-get clean && \
-    rm -rf /var/lib/apt/lists/* /tmp/*.deb
-
-RUN mkdir -p /var/lib/openstack-helm/tftpboot && \
-    cp /usr/lib/ipxe/snponly.efi /var/lib/openstack-helm/tftpboot/
+    rm -rf /var/lib/apt/lists/*
 
 COPY containers/dnsmasq/common/helpers.sh /helpers.sh
 COPY containers/dnsmasq/dnsmasq/entry-point.sh /entry-point.sh