search

samba-in-kubernetes / samba-container

Build Samba Container Images / Kubernetes & Container Runtime Example Files
GNU General Public License v3.0
48 stars 18 forks source link

Missing DNS forwarder setting #154

Open scara opened 1 year ago

scara commented 1 year ago

Hello everyone, just playing with quay.io/samba.org/samba-ad-server:v0.3 to create on-the-fly AD DC for testing purposes, as a single container not running under K8s.

For my use case it would be of great value to have the possibility to (optionally) set dns forwarder = ...: I found nothing related on https://github.com/samba-in-kubernetes/sambacc/blob/627c6c09a9f198f6f8ad46412bf970f72ad6745e/sambacc/addc.py#L99C1-L100 and not sure how to properly force it into the container.

TIA, Matteo

phlogistonjohn commented 1 year ago

Thanks for the feedback! There's currently no great way to get custom settings into the AD DC container (this is not the case for the file server container). This is due to the fact that the AD DC provision command makes the smb.conf file and how it does that. There's an issue for this in sambacc samba-in-kubernetes/sambacc#43 - I started working on it but found it was trickier than I anticipated. I did find out from Andrew Bartlett of the samba team there are other approaches but those ended up fairly tricky to implement too. At one point I wondered if it would be worth trying to patch samba-tool.

This is not an excuse, but rather an explanation of why I haven't gotten back to it! ;-) Maybe I'll have the motivation to look again soon. Also, anyone should feel free to try and contribute the feature if you're up to it.

phlogistonjohn commented 1 year ago

I forgot to mention: for what it's worth one can manipulate the generated smb.conf after the provision is done. So if the settings in question are not needed for provisioning it's possible to do that (esp. if you're storing the /etc/samba as a persistent volume). But it's annoying, I know.

phlogistonjohn commented 1 year ago

I keep forgetting things. In case it helps: the way we set up our AD DC instances we configure the internal k8s dns server to delegate to the AD DC for certain subdomains. When the in-cluster applications refer to domains outside of the DC's domain the resolution doesn't need to go through the DC's DNS. This principle would also apply to systems outside of the k8s cluster but you need to control a DNS server :-)

Example: https://github.com/samba-in-kubernetes/samba-container/blob/193bfe89704dac5d97516c9c58c94ba16daa059a/tests/test-deploy-ad-server.sh#L57-L92

Maybe that'll be useful to you as a workaround for not being able to set dns forwarder for now.

scara commented 1 year ago

Thanks @phlogistonjohn for your fast reply and insights! For my use case the AD DC DNS will be the primary one, unfortunately.

samba-container/tests/test-deploy-ad-server.sh

Nice hack!

In the mean time, I'll explore the other sambacc caps.

TIA, Matteo