[WIP] DNS provider framework - PowerDNS plugin by sudo87 · Pull Request #12737 · apache/cloudstack

sudo87 · 2026-03-03T11:49:04Z

Description

This PR introduces initial implementation for a plugin based DNS framework in Apache CloudStack. It enables both admin and end-users to manage DNS zones and record with external authoritative dns providers. PowerDNS is the first provider for initial implementation.

Github issue: #9958
Cwiki: https://cwiki.apache.org/confluence/display/CLOUDSTACK/DNS+Framework+and+Plugins

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

…teDnsServer

2. added relevant changes in dao and vo 3. worked on creatednszone, integration with mgr 4. powerdns create zone api call

1. creatednszone 2. listdnszone 3. updatednszone 4. deletednszone

1. Add dns server 2. create zone 3. add records 4. verify in powerdns 5. verify using dig

1. Registerdnsrecordforvm api 2. removednsrecordforvm api 3. cleanup; fixed license, dao logic

1. refactored client 2. added exceptions 3. enhanced updateZone 4. ownership check for deleteDnsServer

1. port for dns_server 2. remove hard coded localhost for server_id 3. resolve and store server id if not passed in the api request 4. restrict public dns_server for domain admins and admins

…n svc and handle dot version in client

…elete events 2. add dnsrecordurl in nic_details table 3. add dnsrecordurl in vm response

codecov · 2026-03-03T12:02:37Z

Codecov Report

❌ Patch coverage is 71.12737% with 671 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.23%. Comparing base (4f93ba8) to head (883dc32).
⚠️ Report is 25 commits behind head on main.

Files with missing lines	Patch %	Lines
.../apache/cloudstack/dns/DnsProviderManagerImpl.java	58.36%	281 Missing and 40 partials ⚠️
...apache/cloudstack/dns/powerdns/PowerDnsClient.java	73.83%	34 Missing and 28 partials ⚠️
...g/apache/cloudstack/dns/dao/DnsNicJoinDaoImpl.java	0.00%	45 Missing ⚠️
.../src/main/java/com/cloud/vm/UserVmManagerImpl.java	21.81%	42 Missing and 1 partial ⚠️
...ava/org/apache/cloudstack/dns/vo/DnsNicJoinVO.java	0.00%	33 Missing ⚠️
...n/java/org/apache/cloudstack/dns/vo/DnsZoneVO.java	53.57%	24 Missing and 2 partials ⚠️
...pache/cloudstack/api/response/DnsZoneResponse.java	55.81%	18 Missing and 1 partial ⚠️
...che/cloudstack/api/response/DnsServerResponse.java	69.23%	11 Missing and 1 partial ⚠️
.../main/java/com/cloud/vm/dao/NicDetailsDaoImpl.java	0.00%	12 Missing ⚠️
...ava/org/apache/cloudstack/dns/DnsProviderUtil.java	76.47%	6 Missing and 6 partials ⚠️
... and 32 more

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12737      +/-   ##
============================================
+ Coverage     18.00%   18.23%   +0.22%     
- Complexity    16455    16808     +353     
============================================
  Files          5976     6031      +55     
  Lines        537582   540519    +2937     
  Branches      66006    66359     +353     
============================================
+ Hits          96784    98539    +1755     
- Misses       429885   430964    +1079     
- Partials      10913    11016     +103

Flag	Coverage Δ
uitests	`3.49% <ø> (-0.04%)`	⬇️
unittests	`19.42% <71.12%> (+0.25%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-03-09T16:13:30Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

…and ownership issue for associate/disassociate dnsZoneToNetwork

1. Remove usage of in-memory eventBus for VM lifecycle events 2. Publish event for VM, NIC and DNS record delete events into messageBus 3. Introducer subscribers for above topics

sudo87 · 2026-03-26T04:19:10Z

@blueorangutan package

blueorangutan · 2026-03-26T04:20:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-03-26T04:58:17Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17245

github-actions · 2026-03-31T14:13:36Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

1. new messageSubscriber to handle dns record create/delete event 2. instance dns record registration uses hostname, prepend random 3 char if conflict

sudo87 · 2026-04-06T13:54:40Z

@blueorangutan package

blueorangutan · 2026-04-06T13:56:07Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

weizhouapache · 2026-04-08T06:47:08Z

@blueorangutan package

blueorangutan · 2026-04-08T06:48:04Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-04-08T07:36:16Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17395

weizhouapache

technically it looks fine overall.

left some minor comments

weizhouapache · 2026-04-08T09:45:11Z

api/src/main/java/org/apache/cloudstack/api/command/user/dns/CreateDnsRecordCmd.java

+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, required = true, description = "Record name")
+    private String name;
+
+    @Parameter(name = ApiConstants.TYPE, type = CommandType.STRING, required = true, description = "Record type (A, CNAME)")


@sudo87
It looks like more record types are supported, right ?
if so, can you update the description ?

weizhouapache · 2026-04-08T09:56:08Z

plugins/dns/powerdns/pom.xml

+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>


are these properties needed ? @sudo87

engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql

weizhouapache · 2026-04-08T09:58:27Z

engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql

+
+-- Set default limit to 10 DNS zones for standard Accounts
+INSERT INTO `cloud`.`configuration` (`category`, `instance`, `component`, `name`, `value`, `description`, `default_value`)
+VALUES ('Advanced', 'DEFAULT', 'ResourceLimitManager', 'max.account.dns_zones', '10', 'The default maximum number of DNS zones that can be created by an Account', '10');


what about projects and domains ?

We can enforce limits per project/domain. I wasn't sure if it would make sense to put it at project or domain level.

We can revisit this in next phase during resource limit enforcement.

weizhouapache · 2026-04-08T10:03:16Z

server/src/main/java/org/apache/cloudstack/dns/vo/DnsServerVO.java

+
+    @Encrypt
+    @Column(name = "api_key")
+    private String apiKey;


the API parameter is credentials, but database column name is api_key

what if there are multiple secrets ? for example both credentials and apikey (just an example) ?
can they be stored in the same column with a separator ?

There is another param "dns_username" (might rename) which could be used with other providers following apiKey : apiSecret kind of credential.

sudo87 · 2026-04-10T02:38:11Z

@blueorangutan package

blueorangutan · 2026-04-10T02:40:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-04-10T03:32:54Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17431

1. handle vm hostname change for dns registration 2. generate event for dns name collision 3. remove dns record lifecycle subscriber

sudo87 · 2026-04-10T10:07:17Z

@blueorangutan package

blueorangutan · 2026-04-10T10:08:04Z

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-04-10T10:59:41Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17445

sudo87 added 22 commits February 9, 2026 10:52

wip: dns provider framework

7b9fc0e

add db schema, vo and dao classes

b2d597c

add powerdns module in plugins

6ef7f9b

Changes done to AddDnsServer, ListDnsServer, DeleteDnsServer and Upda…

9911c28

…teDnsServer

1. Setup Dns zone schema

df21318

2. added relevant changes in dao and vo 3. worked on creatednszone, integration with mgr 4. powerdns create zone api call

following dns zone apis are integrated:

f29b8be

1. creatednszone 2. listdnszone 3. updatednszone 4. deletednszone

Tested following flow:

9b77c37

1. Add dns server 2. create zone 3. add records 4. verify in powerdns 5. verify using dig

Add associate and disassociate zone to network APIs

c5972ae

following things are done:

99f8c7d

1. Registerdnsrecordforvm api 2. removednsrecordforvm api 3. cleanup; fixed license, dao logic

add missing license, cleanup, log std

e011ce1

following changes are done:

4a9f66d

1. refactored client 2. added exceptions 3. enhanced updateZone 4. ownership check for deleteDnsServer

include:

c64cf81

1. port for dns_server 2. remove hard coded localhost for server_id 3. resolve and store server id if not passed in the api request 4. restrict public dns_server for domain admins and admins

normalize dns zone and record in svc layer, always use dotless data i…

4df11a4

…n svc and handle dot version in client

enable apis for all roles

857436e

add ACL annotation, entitytype, minor cleanup

582b687

acl related changes, fixes, mistakes

add7763

fixes related to acl, dao

1fe79bd

add views for dns_server and dns_zone

6ca9d5a

Add Listener for VM lifecycle to add dnsrecords for associated dns zone

1c1eef3

1. implement event processing for vm start/stop/destroy, nic create/d…

caf8533

…elete events 2. add dnsrecordurl in nic_details table 3. add dnsrecordurl in vm response

starting on ui work

856158c

resolve merge conflict with main

928db65

boring-cyborg bot added the component:api label Mar 3, 2026

fix lint issue

369bb16

winterhazel added this to the 4.23.0 milestone Mar 3, 2026

fix list dnsservers api, ui screens for dns servers, generate events

0df50ce

github-actions bot added the status:has-conflicts label Mar 9, 2026

UI related work and fixes in updateDnsServer cmd

a9afbce

sudo87 force-pushed the dnsProviderFramework branch from e9de026 to 981bb64 Compare March 19, 2026 11:12

sudo87 added 2 commits March 20, 2026 13:10

fix addDnsRecord and deleteDnsRecord flow for automatic registration …

af7ce8e

…and ownership issue for associate/disassociate dnsZoneToNetwork

improve cleanup logic for DNS zone and server

bde9fd9

sudo87 force-pushed the dnsProviderFramework branch from a6e812b to bde9fd9 Compare March 23, 2026 09:31

sudo87 added 2 commits March 23, 2026 18:21

modify delete flow for dns zone and server, ask to key in name

5682a5a

Following changes are part of this commit:

c6abed1

1. Remove usage of in-memory eventBus for VM lifecycle events 2. Publish event for VM, NIC and DNS record delete events into messageBus 3. Introducer subscribers for above topics

github-actions bot added the status:has-conflicts label Mar 31, 2026

sudo87 added 3 commits April 1, 2026 09:44

add unit tests

f1dcd00

resolve conflict with main

f524bbe

unit tests

9d4e141

github-actions bot removed the status:has-conflicts label Apr 1, 2026

Following changes are done:

8d10ae1

1. new messageSubscriber to handle dns record create/delete event 2. instance dns record registration uses hostname, prepend random 3 char if conflict

weizhouapache reviewed Apr 8, 2026

View reviewed changes

fix automatic dns record registration based on vm and nic lifecycle

3567819

changes:

883dc32

1. handle vm hostname change for dns registration 2. generate event for dns name collision 3. remove dns record lifecycle subscriber

Conversation

sudo87 commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Mar 9, 2026

Uh oh!

sudo87 commented Mar 26, 2026

Uh oh!

blueorangutan commented Mar 26, 2026

Uh oh!

blueorangutan commented Mar 26, 2026

Uh oh!

github-actions bot commented Mar 31, 2026

Uh oh!

sudo87 commented Apr 6, 2026

Uh oh!

blueorangutan commented Apr 6, 2026

Uh oh!

weizhouapache commented Apr 8, 2026

Uh oh!

blueorangutan commented Apr 8, 2026

Uh oh!

blueorangutan commented Apr 8, 2026

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

weizhouapache Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

weizhouapache Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

sudo87 Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

weizhouapache Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

sudo87 Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

sudo87 commented Apr 10, 2026

Uh oh!

blueorangutan commented Apr 10, 2026

Uh oh!

blueorangutan commented Apr 10, 2026

Uh oh!

sudo87 commented Apr 10, 2026

Uh oh!

blueorangutan commented Apr 10, 2026

Uh oh!

blueorangutan commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sudo87 commented Mar 3, 2026 •

edited

Loading

codecov bot commented Mar 3, 2026 •

edited

Loading