From 7c060bd52afd1b43bf54639ba5b413d9f5576249 Mon Sep 17 00:00:00 2001 From: Benedikt Trefzer Date: Mon, 9 Mar 2026 11:11:16 +0100 Subject: [PATCH] knot_zone: add parameter to set serial to unixtime --- REFERENCE.md | 32 +++++++++++++++++++ .../provider/knot_zone_private/knotc.rb | 9 ++++++ lib/puppet/type/knot_zone.rb | 10 ++++++ lib/puppet/type/knot_zone_private.rb | 9 ++++++ manifests/domain.pp | 5 +++ spec/defines/domain_spec.rb | 3 ++ 6 files changed, 68 insertions(+) diff --git a/REFERENCE.md b/REFERENCE.md index e5da6c1..dc7e468 100644 --- a/REFERENCE.md +++ b/REFERENCE.md @@ -1182,6 +1182,7 @@ The following parameters are available in the `knot::domain` defined type: * [`manage_zone`](#-knot--domain--manage_zone) * [`zone_content_filter`](#-knot--domain--zone_content_filter) * [`zone_show_diff`](#-knot--domain--zone_show_diff) +* [`zone_serial_policy`](#-knot--domain--zone_serial_policy) * [`zone_manage_records`](#-knot--domain--zone_manage_records) * [`zone_soa_ttl`](#-knot--domain--zone_soa_ttl) * [`zone_soa_class`](#-knot--domain--zone_soa_class) @@ -1645,6 +1646,15 @@ remark: only relevant if $manage_zone set to true Default value: `undef` +##### `zone_serial_policy` + +Data type: `Enum['increment', 'unixtime']` + +serial policy to use if records are managed with puppet. +(this is separate to the serial-policy set in knot, which is used for knot dynamic update or automatic dns signing) + +Default value: `'increment'` + ##### `zone_manage_records` Data type: `Optional[Boolean]` @@ -2447,6 +2457,7 @@ The following parameters are available in the `knot_zone` type. * [`local_subzones`](#-knot_zone--local_subzones) * [`manage_records`](#-knot_zone--manage_records) * [`name`](#-knot_zone--name) +* [`serial_policy`](#-knot_zone--serial_policy) * [`show_diff`](#-knot_zone--show_diff) * [`soa_class`](#-knot_zone--soa_class) * [`soa_expire`](#-knot_zone--soa_expire) @@ -2488,6 +2499,16 @@ namevar name of the zone name as namevar +##### `serial_policy` + +Valid values: `increment`, `unixtime` + +specify how the serial is incremented after a dns change. Possible values are: +increment: increment existing serial by one +unixtime: set the serial to the current unix time + +Default value: `increment` + ##### `show_diff` Valid values: `true`, `false`, `yes`, `no` @@ -2579,6 +2600,7 @@ The following parameters are available in the `knot_zone_private` type. * [`manage_records`](#-knot_zone_private--manage_records) * [`name`](#-knot_zone_private--name) * [`provider`](#-knot_zone_private--provider) +* [`serial_policy`](#-knot_zone_private--serial_policy) * [`show_diff`](#-knot_zone_private--show_diff) ##### `content_filter` @@ -2613,6 +2635,16 @@ name of the zone name as namevar The specific backend to use for this `knot_zone_private` resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform. +##### `serial_policy` + +Valid values: `increment`, `unixtime` + +specify how the serial is incremented after a dns change. Possible values are: +increment: increment existing serial by one +unixtime: set the serial to the current unix time + +Default value: `increment` + ##### `show_diff` Valid values: `true`, `false`, `yes`, `no` diff --git a/lib/puppet/provider/knot_zone_private/knotc.rb b/lib/puppet/provider/knot_zone_private/knotc.rb index a5bed3a..d2b3615 100644 --- a/lib/puppet/provider/knot_zone_private/knotc.rb +++ b/lib/puppet/provider/knot_zone_private/knotc.rb @@ -80,6 +80,15 @@ def content=(content) knotc(knotc_options, 'zone-abort', "#{resource[:name]}.") raise Puppet::Error, "update of knot using knotc failed (aborted any open session) #{e}" end + + # we already incremented serial above. if unixtime is specified, we continue to set + return unless resource[:serial_policy].to_s == 'unixtime' + + begin + knotc(knotc_options, 'zone-serial-set', "#{resource[:name]}.", Time.now.to_i) + rescue Puppet::Error + # we already incremented above, so we can ignore + end end def content diff --git a/lib/puppet/type/knot_zone.rb b/lib/puppet/type/knot_zone.rb index f511ada..b0cbd1a 100644 --- a/lib/puppet/type/knot_zone.rb +++ b/lib/puppet/type/knot_zone.rb @@ -33,6 +33,15 @@ defaultto :false end + newparam(:serial_policy) do + desc 'specify how the serial is incremented after a dns change. Possible values are: + increment: increment existing serial by one + unixtime: set the serial to the current unix time + ' + newvalues('increment', 'unixtime') + defaultto 'increment' + end + newparam(:manage_records, boolean: true, parent: Puppet::Parameter::Boolean) do desc 'If puppet shall manage all zone records for the domain (any records not managed with puppet will be purged). The default is true, to manage the SOA record and all zone records through puppet for the zone. @@ -153,6 +162,7 @@ def generate content_filter show_diff local_subzones + serial_policy manage_records].each do |p| knot_zone_private_opts[p] = self[p] unless self[p].nil? end diff --git a/lib/puppet/type/knot_zone_private.rb b/lib/puppet/type/knot_zone_private.rb index dce5750..5a5bd9e 100644 --- a/lib/puppet/type/knot_zone_private.rb +++ b/lib/puppet/type/knot_zone_private.rb @@ -40,6 +40,15 @@ defaultto :false end + newparam(:serial_policy) do + desc 'specify how the serial is incremented after a dns change. Possible values are: + increment: increment existing serial by one + unixtime: set the serial to the current unix time + ' + newvalues('increment', 'unixtime') + defaultto 'increment' + end + newparam(:local_subzones) do desc 'local subzones for which we query NS ans CDS records and add dem to the local zone, only works if the subzone is configured on current node' defaultto [] diff --git a/manifests/domain.pp b/manifests/domain.pp index d567d89..9171f24 100644 --- a/manifests/domain.pp +++ b/manifests/domain.pp @@ -127,6 +127,9 @@ # Whether to display differences when the zone changes, defaulting to # false. Since zones can be huge, use this only for debugging # remark: only relevant if $manage_zone set to true +# @param zone_serial_policy +# serial policy to use if records are managed with puppet. +# (this is separate to the serial-policy set in knot, which is used for knot dynamic update or automatic dns signing) # @param zone_manage_records # If puppet shall manage all zone records for the domain (any records not managed with puppet will be purged). # The default is true, to manage the SOA record and all zone records through puppet for the zone. @@ -246,6 +249,7 @@ Boolean $manage_zone = false, Optional[String[1]] $zone_content_filter = undef, Optional[Boolean] $zone_show_diff = undef, + Enum['increment', 'unixtime'] $zone_serial_policy = 'increment', Optional[Boolean] $zone_manage_records = undef, Optional[String[1]] $zone_soa_ttl = undef, Optional[String[1]] $zone_soa_class = undef, @@ -322,6 +326,7 @@ zone_ensure => $ensure, content_filter => $zone_content_filter, show_diff => $zone_show_diff, + serial_policy => $zone_serial_policy, manage_records => $zone_manage_records, soa_ttl => $zone_soa_ttl, soa_class => $zone_soa_class, diff --git a/spec/defines/domain_spec.rb b/spec/defines/domain_spec.rb index 083013d..cbea938 100644 --- a/spec/defines/domain_spec.rb +++ b/spec/defines/domain_spec.rb @@ -8,6 +8,7 @@ manage_zone: false, zone_records: [], zone_nameservers_ttl: 3600, + zone_serial_policy: 'increment', zone_nameservers: [], zone_subzones: {}, local_subzones: [] } @@ -22,6 +23,7 @@ if params[:manage_zone] is_expected.to contain_knot_zone(params[:domain]) .with_zone_ensure(params[:ensure]) + .with_serial_policy(params[:zone_serial_policy]) .with_manage_records(params[:zone_manage_records]) .with_local_subzones(params[:local_subzones]) if params[:ensure] == 'present' @@ -121,6 +123,7 @@ ensure: 'present', domain: 'example.net', manage_zone: true, + serial_policy: 'unixtime', zone_records: [{ rname: 'test', rcontent: '1.1.1.1' }, { rname: 'test', rtype: 'AAAA', rcontent: '::1' }], zone_nameservers: ['ns1.example.org.', 'ns2.example.org.'], zone_subzones: { 'sub' => { 'nameservers' => ['ns1.example.org'], 'trust_ds' => ['1 1 1 ttt'] } },