Re: Seeking advice for deploying an anycast cluster

--===============8157654890654731406==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="T7mxYSe680VjQnyC"
Content-Disposition: inline


--T7mxYSe680VjQnyC
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Subject: Re: [nsd-users] Seeking advice for deploying an anycast cluster Da=
te: Fri, Jan 03, 2020 at 09:22:46PM -0500 Quoting Daniel Corbe via nsd-user=
s ([email protected]):
>=20
> So I'm worried about nsd getting the right information from the right
> source.   If I put my nsd instances in a "full mesh" so to speak,
> where they are all XFR and NOTIFY each other, my "A" and "B" PowerDNS
> servers would still need to be the authoritative source for
> information.  I'm assuming that's where the serial number of the zone
> comes into play?   Highest provided serial number wins, right?

Correct.=20

Don't forget that you would be wise to include TSIG as well. Here, between
servers managed by the same entity, it is child's play. And being able
to prove that the AXFR is correct all the way is quite beneficial.

Further, you need a system to manage the "new zone deployment" process,
as well as removal (but adding is more time-critical than removal). I've
used "dper.pl" from Kirei (https://github.com/kirei/dper) to automate
this for quite a few years now. No hickups. A new version that is Python
and YAML is in the works, of which I will have experience soon.

In summary:=20

* every slave should fetch its zone from at least 2 masters,=20

* serial governs which zone is loaded and served,=20

* TSIG set up between masters and slaves,=20

* NOTIFY (by virtue of "also-notify" in BIND and PowerDNS syntax) makes
  things fast,

* Zone deployment is and was always supposed to be OOB, and needs to
  be handled. (NB: There with some frequency pops up suggestions to do
  in-band provisioning, and I THINK I've seen it on the feature list for
  some implementations, but no standard method has yet been devised.)


rgds,=20
--=20
M=C3=A5ns Nilsson     primary/secondary/besserwisser/machina
MN-1334-RIPE           SA0XLR            +46 705 989668
I hope I bought the right relish ... zzzzzzzzz ...

--T7mxYSe680VjQnyC
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEpp2QVFhCcv+wDUfCDgtx4NP2G7QFAl4QPZkACgkQDgtx4NP2
G7Tpyw/+ONkA6xx8lWYJkia9bMqVsLp2IRBhOAsTOrT20DHgaKeatVdJMaTWvLU6
GgDLAOJm06EF9zLQjdDJycc7MW3vf531ysRgkNfqBRGb4/cjmf00BkPvfNM71RnU
qxtDD1pqF4OuZiO6MiwLxzie5iaiIf7LvbO7fDmco2ZkJ44N+JeeUlyfcoawWuaQ
jMVl8hvrQw9wLcYHqJz3AI24p90YNwxdxT28GnfifBjZX6fr3K0yZKNiZ3DLQhsh
HTwoGeqtAVjZUxwWxwl1sh6JLtwJuUipWRu0INn86KE/pcFHgbQowaAHX/DIZSEx
fqIjSZdTRL7LEs+96UMmYMl0oxWCgnpLFjt7RwAbYsMfZnAQOgfpb+8XkLqWW5B3
CpyKJAJ805dOB4DXntRxhTrV25JiBfAm3IS1DkJEo3hnm41GVGkcFNB0y9rFSe04
rEOUosBG7kJ7LdXq8M2+1WEMzCyQMY1od4cMJ+y5ATky2hNVvMZOmOVjhuaR1OQG
mBMGKC4nCY/P8f9Lh/vCuxj/jW+n2Lg3UNPmJ/kc7XbKj9SUvj7gIpdrEB+2xJst
qCKyMs+0OMqsXS4ZuCiMVJQetHKHJCTAGfGMu/DRZWJ9sNbTdtKaRyn8J/w+UCcY
tKgZwbhKy2ggneHJuoc6YP5xKfyYnqOAy/4M2kOs/58+4+zji/U=
=qo5E
-----END PGP SIGNATURE-----

--T7mxYSe680VjQnyC--

--===============8157654890654731406==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


_______________________________________________
nsd-users mailing list
[email protected]
https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users

--===============8157654890654731406==--