abaltic opened a new issue, #14525:
URL: https://github.com/apache/cloudstack/issues/14525
### ISSUE TYPE
- Improvement Request / Bug Report
### COMPONENT NAME
DNS Framework (PowerDNS provider), API, UI
### CLOUDSTACK VERSION
<your version, e.g. 4.23.0.0>
### SUMMARY
The new DNS Framework works well for provider-owned zones, but in a
multi-tenant
cloud there is no way for a tenant to manage a zone for a domain they own
(e.g. `customer.com`). Every tenant zone is forced under the public server's
suffix, and the admin cannot create a server entry or zone on a tenant's
behalf.
### OBSERVED BEHAVIOUR
1. `addDnsServer` called by a non-root account fails with
"This API can only be called by root admin".
The documentation states that admins **and domain admins** can create
public
DNS servers, so either the docs or the permission check is wrong.
2. Only one DNS server entry per account + URL is allowed
("This Account already has a DNS server integration for URL: ...").
3. `addDnsServer` and `createDnsZone` have no `account`, `domainid` or
`projectid` parameters (verified with `list apis ... filter=params`),
so root cannot create a server entry or zone owned by a tenant.
4. Zones created by root are owned by root and are not visible to tenants.
5. Tenants creating zones on a public server are always restricted to the
single `publicdomainsuffix`.
Result: a tenant who owns `customer.com` and delegates it to our nameservers
cannot manage that zone through CloudStack. The only workarounds are manual
management by root, a separate DNS UI outside CloudStack, or CNAMEs from the
vanity zone into a suffixed tenant zone.
### USE CASE
- Provider runs a PowerDNS cluster and wants to offer managed DNS to tenants.
- Default: tenants self-serve zones under `cloud.provider.example`
(works today).
- Some tenants own their own domains (`customer.com`), delegate them to the
provider's nameservers, and need to manage records (A, MX, TXT, CNAME)
and VM auto-registration for them, without access to the PowerDNS API key.
### PROPOSED IMPROVEMENTS
1. Add `account` + `domainid` (and `projectid`) to `addDnsServer` and
`createDnsZone`, consistent with other CloudStack resource APIs, so root
can provision a server entry or zone owned by a tenant.
2. Alternatively, an API to change zone ownership
(e.g. `assignDnsZone` / `updateDnsZone account=... domainid=...`).
3. Allow domain admins to call `addDnsServer` as documented, or update the
docs if root-only is intended.
4. Allow multiple allowed suffixes per public server, or per-domain suffix
rules (e.g. domain `ROOT/CustomerA` may create `customer.com`).
5. Optional: an ownership verification step (TXT challenge) before a tenant
can create a zone outside the public suffix, to prevent zone squatting.
### STEPS TO REPRODUCE
1. As root admin, add a public PowerDNS server with
`publicdomainsuffix=cloud.provider.example`.
2. As a tenant user, try to create zone `customer.com` -> forced under the
suffix.
3. As a tenant user or domain admin, try `addDnsServer` -> "can only be
called by root admin".
4. As root, try `addDnsServer` again with the same URL -> "already has a DNS
server integration for URL".
5. As root, create zone `customer.com` -> owned by root, not visible to the
tenant.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
