I know that I can set up Route53 to resolve DNS queries to destination IP addresses in an active-active or active-passive fashion. I was thinking how to achieve DNS redundancy in case AWS Route53 service goes down altogether.
Will I end up with DNS conflicts if I setup my DNS A record entries in both Route53 and Azure DNS?
Related
How can we allow application workloads to manage their own DNS entries when their VMs also need to be joined to an AADDS domain (without violating the principal of least privilege)?
Background
We have the following network configuration:
A Hub VNET containing an Azure AD Domain Services (AADDS) managed domain called mydomain.co.uk. This VNET will also host a VNET Gateway, a Bastion instance and a couple of management VMs.
Multiple "environment" VNETs, all peered to the Hub, to run application workloads. These workloads all currently running on on domain-joined VMs & VMSSs that are behind both an Standard Load Balancer (for internal traffic), and an Application Gateway (for public traffic). The IP addresses of those load balancers and App Gateways need to be resolvable via DNS.
Requirements
We would like all applications to be resolvable using the same TLD domain - both internally and externally (e.g. myapp.env1.mydomain.co.uk should work internally and externally).
The Hub is created by a single pipeline running a terraform configuration that is maintained by the Platform team. The platform Team should not need to be involved when provisioning environments.
Each environment is created by its own pipeline, running terraform configurations that are maintained by the various Product Teams. The Product Teams should be able to spin up & destroy environments without any input from the Platform Team.
Problem
Public DNS resolution was easy to setup. We simply granted each environmental pipeline permission to register records in an Azure public DNS zone. The problem arose when we tried to solve internal DNS Resolution.
We tried creating a Private DNS zone for `mydomain.co.uk and linking it to the environmental VNETs. Unfortunately, the VMs in those VNETs then fail to join to the domain due to the lack of domain SRV records (these are created by default in AADDS). So it seems that AADDS requires that any VNETs containing VMs that want to join to the domain use its IP addresses for DNS resolution. This means any apps running on those VMs must send their DNS query to AADDS, not to an Azure Private DNS Zone.
We thought about giving the environment pipelines permission to create records in the AADDS DNS zone. Unfortunately, the Microsoft docs say that only users that are members of the "AAD DC Administrators" group can add/remove DNS records. This is far too much power to give to the environmental pipelines (it would allow them to delete other workloads' VMs from the domain for example).
We then tried linking the Private DNS zone to the Hub VNET, in the hope that we could configure AADDS to forward any DNS requests that it can't resolve to Azure DNS. Unfortunately, AADDS does not forward any DNS requests for mydomain.co.uk onto Azure DNS - presumably because it believes it is authoritative for that zone.
Is there another mechanism that we haven't thought of yet?
• Since, you want the app workloads running on VMs in the spoke virtual network to search or forward the DNS requests from the Azure private DNS zone to the AADDS, you can surely leverage the functionality of conditional forwarder in this regard. Thus, to use this functionality, you would need to configure a VM as a ‘Domain Controller’ for this managed domain and associate it in a subnet that is reachable to all the domain joined resources in the hub and spoke virtual network model.
To join a VM to a managed domain and configure it as a ‘Domain Controller’ for serving the full features of ADDS and DNS, kindly refer to the below link for more details: -
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns#before-you-begin
Also, to configure the conditional forwarder in AADDS joined VM configured as a DC, ensure to install DNS Server tools, and use the DNS console to manage the records in AADDS as well as follow the steps below to configure a conditional forwarder in the AADDS VM: -
a) Login to a VM and open the ‘Administrative Tools’ --> ‘DNS’ --> DNS Management Console opens --> Connect to DNS Server dialog
b) Select Conditional Forwarders, then right select and choose New Conditional Forwarder --> enter the other DNS domain such as for example, ‘contoso.com’, then enter the IP addresses of the DNS servers for that namespace as shown below: -
c) Check the box for Store this conditional forwarder in Active Directory, and replicate it as follows, then select the option for ‘All DNS servers in this domain’, as shown in the following example: -
‘Conditional forwarder should be stored in the domain, not in the forest’
d) Name resolution of the resources in other namespaces from VMs connected to the managed domain should now resolve correctly. Queries for the DNS domain configured in the conditional forwarder are passed to the relevant DNS servers (Azure private DNS zone) and from there, the Azure VMs mapped or registered in there will be forwarded the DNS requests accordingly.
Thus, in this way, if you configure AADDS to forward any DNS requests to the Azure private DNS zone with the help of conditional forwarder, you would be able to forward the DNS requests for ‘mydomain.co.uk’ to the Azure private DNS zone for further resolution.
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/manage-dns#create-conditional-forwarders
A comment on the above answer (thanks #Kartik), led me to the ultimate answer... which is that I'm trying to do something that is not recommended by Microsoft :-(
Apparently, I shouldn't be using the same name for both my AADDS managed domain and my application workloads:
https://learn.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance#create-a-managed-domain
If you create a custom domain name, take care with existing DNS namespaces. It's recommended to use a domain name separate from any existing Azure or on-premises DNS name space.
For example, if you have an existing DNS name space of contoso.com, create a managed domain with the custom domain name of aaddscontoso.com. If you need to use secure LDAP, you must register and own this custom domain name to generate the required certificates.
It seems I am going to have to:
Choose another name for my managed domain (e.g. aadds.mydomain.co.uk)
Set all VNETs to use it for DNS resolution.
Setup a DNS forwarder to an Azure Private DNS zone containing the records for my workloads (mydomain.co.uk).
We have a virtual machine created in Azure which is using a private VNet configured with custom DNS servers in order to domain join the VM (eg. contoso.com)
Now we have a private DNS zone (eg subdomain.contoso.com) created in Azure which is linked to the same VNet as the VM. However, we are not able to resolve the private DNS entries from within the domain joined VM as I believe, Azure query the Azure private DNS with the IP 168.63.129.16
Is there a way we can forward DNS requests from a VM in Azure VNet using custom DNS servers to Azure private DNS zone linked to the same VNet?
Any help is much appreciated. Thanks.
By using Azure Private DNS, you can resolve domain names in a virtual network without the need to add a custom DNS solution.
By using private DNS zones, you can use your own custom domain names rather than the Azure-provided names available today
Is there a way we can forward DNS requests from a VM in Azure VNet
using custom DNS servers to Azure private DNS zone linked to the same
VNet?
If you have created custom DNS private zone, you can enable Autoregistration feature so that DNS requests from your VM in the VNET will be forwarded to the Azure private DNS zone
I have a AKS cluster with default FQDN name with the suffix of "cloudapp.azure.com". I want to get a domain and apply it to the cluster but am not sure how to apply custom domain to Kubernetes cluster in azure.
Can anyone help me with the steps to apply custom domain name to AKS cluster?
If I understand you correctly, you've already deployed your application on Kubernetes and want to connect it to your custom domain name.
For this purpose you can use NGINX Ingress Controller.
Below I will briefly describe how you can do it on AKS:
First you need to create an ingress controller and ingress resource. For Azure AKS detailed instructions can be found here: create-an-ingress-controller.
Note: By default, the public IP address acquired by NGINX Ingress is lost
if the controller is deleted. I recommend you to
create static public IP address, because it remains if the ingress controller is deleted.
Next identify the public IP address (EXTERNAL-IP) associated with
your NGINX Ingress service that was created in the previous step.
Now you need to create an A DNS record, to point your domain to the cluster.
Additionally you may
want to provide CNAME record, but is isn't mandatory and depends
on your needs.It is possible to create Azure DNS Zone for your
custom domain and then add appropriate record sets to this zone.
Note: Azure DNS is not the domain registrar, you have to configure the
Azure DNS name servers as the correct name servers for
the domain name with the domain name registrar. For more
information, see Delegate a domain to Azure DNS.
Azure won't provide you the DNS names, but it has a service named as DNS zone, where you can register your custom domain ( that you may have from providers like GoDaddy etc ), the externalIP of the ingress or any other load balancer that you see in the AKS clusters can be mapped to this custom domain name in the DNS zone and this will take the traffic to the respective AKS cluster.
Advantage of DNS zone is that, you can enter multiple alias URLs as well and can make them to take traffic to AKS cluster, like
abc.com is your domain ( let's say )
api.abc.com is for mobile applications to communicate with AKS and this can be pointed to same URL via CNames in DNS zone.
You can have multiple options here based on your usecase, refer Azure's documentation on DNS zones for that
I have a problem with DNS resolving Azure machines from on-premise network connected with VPN to VMs' virtual network. In other cloud providers there are solutions to this problem, but I can't find one in Azure. In AWS I could create Inbound Route53 Endpoint which gives me IPs in the VPC that machines from my on-premise network can reach. In GCP there is forwarding DNS server policy. Is there any similar solutions in Azure ?
To resolve the DNS name of Azure VMs from an on-premise network, you need forward queries to your managed DNS proxy server in the corresponding virtual network, the proxy server forwards queries to Azure for resolution. The DNS servers in the virtual networks can forward DNS queries to the recursive resolvers (168.63.129.16) in Azure.
Note that Azure Private Zones does not help in this situation, you have to use your own DNS proxy server. Read here.
For more references:
Name resolution for resources in Azure virtual networks
Name resolution using your own DNS server
Is there a way to point an Azure NIC to the records one created in an Azure DNS zone?
At present Azure DNS doesn't support private DNS zones, i.e. those only available to your vnet. Also, the DNS servers specified in the "Add DNS server" box needs to be a recursive resolver, Azure DNS is an Authoritative DNS service, i.e. it will only serve answers for the zones it hosts.
We can't add Azure DNS zone to NIC custom DNS. The custom DNS required IP address, we can add the DNS server IP address to it.
For example, we can add 8.8.8.8 to it, also we can add local DNS server IP address to it(need VPN). Or create a Azure windows VM and install DNS role on it, and add this VM ip address to it.
If you want to use Azure DNS zone to manage your records, we can map your own domain name to DNS zone, and add name servers to your domain name(add this by domain name registrar manage webpage).
The following image shows an example DNS query about Azure DNS zone:
If you want to add record to DNS zone, and you want to map your 3rd party domain name map to Azure DNS zone, we can follow those steps in that answer.
Note:
Keep in mind Azure DNS is not the domain registrar, we should buy domain name from domain registrar(like godaddy, register.com).
Update:
If you just want to use domain name in your virtual network, there is no need to buy a domain, we can use AAD DS in our virtual network. Or we can deploy a VM and install DC on it, work as on-prem.
By the way, in the same virtual network, we can ping VM's name by default.