Bug 1162901 - ensure correct dns key algo used

https://bugzilla.redhat.com/show_bug.cgi?id=1162901

- Previously register_dns.pp used pick to choose between
  bind_key_algorithm and dns_infrastructure_key_algorithm, but since
  they both had default values of HMAC-MD5,
  dns_infrastructure_key_algorithm was always used.
- show list of skipped hostnames in nsupdate command (debug output)
- fail if bind_key is not set and dns_infrastructure_zone is not set
- fail if dns_infrastructure_key is not set and dns_infrastructure zone
  is set

Author: detiber

manifests/plugins/dns/nsupdate.pp

@@ -65,5 +65,5 @@
       mode    => '0644',
       notify  => Service['openshift-broker'],
       require => $nsupdate_requirements
-    }
+  }
 }

manifests/register_dns.pp

@@ -19,13 +19,27 @@
           ensure  => present,
           require => Class['openshift_origin::install_method'],
       }
-      $key_algorithm=pick($::openshift_origin::dns_infrastructure_key_algorithm,
-        $::openshift_origin::bind_key_algorithm)
-      $key_secret=pick($::openshift_origin::dns_infrastructure_key,
-        $::openshift_origin::bind_key)
-      $key_domain=pick($::openshift_origin::dns_infrastructure_zone,
-        $::openshift_origin::domain)
-      $key_argument="${key_algorithm}:${key_domain}:${key_secret}"
+
+      if $::openshift_origin::dns_infrastructure_zone == '' {
+        $key_domain = $::openshift_origin::domain
+        $key_algorithm = $::openshift_origin::bind_key_algorithm
+
+        if $::openshift_origin::bind_key == '' {
+          fail 'bind_key is required when setting register_host_with_nameserver to true.'
+        }
+        $key_secret = $::openshift_origin::bind_key
+      }
+      else {
+        $key_domain = $::openshift_origin::dns_infrastructure_zone
+        $key_algorithm = $::openshift_origin::dns_infrastructure_key_algorithm
+
+        if $::openshift_origin::dns_infrastructure_key == '' {
+          fail 'dns_infrastructure_key is required when setting register_host_with_nameserver to true when using the dns_infrastructure_zone parameter.'
+        }
+        $key_secret = $::openshift_origin::dns_infrastructure_key
+      }
+
+      $key_argument = "${key_algorithm}:${key_domain}:${key_secret}"
 
       exec { "Attempting to register host dns" :
         command   => template('openshift_origin/register_dns.erb'),

templates/register_dns.erb

@@ -1,20 +1,30 @@
-  (
-  echo server <%= scope.lookupvar('::openshift_origin::nameserver_ip_addr') %>
-<% role_hostnames = Array.new -%>
+<% hosts_to_check = Array.new -%>
+<% hosts_to_register = Array.new -%>
+<% hosts_to_skip = Array.new -%>
+<% node_ip = scope.lookupvar('::openshift_origin::node_ip_addr') -%>
 <% scope.lookupvar('::openshift_origin::roles').each do |role|
-  role_hostname = scope.lookupvar("::openshift_origin::#{role}_hostname")
-  if role_hostname.gsub(/^[^.]*./, '') == @key_domain
-    role_hostnames << role_hostname
-  end -%>
-<% end -%>
-<% role_hostnames.uniq.each do |role_hostname| -%>
-  echo update delete <%= role_hostname %> A
-  echo update add <%= role_hostname %> 180 A <%= scope.lookupvar('::openshift_origin::node_ip_addr') %>
+  hosts_to_check << scope.lookupvar("::openshift_origin::#{role}_hostname")
+end -%>
+<% if scope.lookupvar('::openshift_origin::load_balancer_master') and scope.lookupvar('::openshift_origin::broker_virtual_ip_address')
+  hosts_to_check << scope.lookupvar('::openshift_origin::broker_virtual_hostname')
+end -%>
+<% hosts_to_check.uniq.each do |h|
+  h.gsub(/^[^.]*./, '') == @key_domain ? hosts_to_register << h :
+	                                 hosts_to_skip << h
+end -%>
+<% unless hosts_to_skip.empty? -%>
+  echo "The following hosts will not be registered with DNS (not a member of <%= @key_domain %>):"
+  <% hosts_to_skip.sort.each do |h| -%>
+    echo "<%= h %>"
+  <% end -%>
 <% end -%>
-<% if scope.lookupvar('::openshift_origin::load_balancer_master') and scope.lookupvar('::openshift_origin::broker_virtual_ip_address') and scope.lookupvar('::openshift_origin::broker_virtual_hostname').gsub(/^[^.]*./, '') == @key_domain -%>
+<% unless hosts_to_register.empty? -%>
 (
-  echo update delete <%= scope.lookupvar('::openshift_origin::broker_virtual_hostname') %> A
-  echo update add <%= scope.lookupvar('::openshift_origin::broker_virtual_hostname') %> 180 A <%= scope.lookupvar('::openshift_origin::broker_virtual_ip_address') %>
-<% end -%>
+  echo server <%= scope.lookupvar('::openshift_origin::nameserver_ip_addr') %>
+  <% hosts_to_register.each do |h| -%>
+    echo update delete <%= h %> A
+    echo update add <%= h %> 180 A <%= node_ip %>
+  <% end -%>
   echo send
 ) | nsupdate -y <%= @key_argument %>
+<% end -%>