fix: DNS entries fix to enabling correct forwarding. (IBM#446)

This is the fix for issue IBM#445 
The configured dns server could not forward the requests to the upper
domain from subdomain.

---------

Signed-off-by: Amadeuds Podvratnik <pod@de.ibm.com>

Author: AmadeusPodvratnik

roles/dns/templates/dns-named.conf.j2

@@ -18,7 +18,7 @@ options {
 	secroots-file	"/var/named/data/named.secroots";
 	recursing-file	"/var/named/data/named.recursing";
 	allow-query     { any; };
-	forwarders { {{ env.cluster.networking.forwarder }}; };
+	forwarders { {{ env.bastion.networking.nameserver2}}; {{ env.cluster.networking.forwarder }}; };
 
 	/*
 	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
@@ -31,9 +31,11 @@ options {
 	   reduce such attack surface
 	*/
 	recursion yes;
+	forward only;
 
 	dnssec-enable no;
 	dnssec-validation no;
+	dnssec-lookaside auto;
 
 	managed-keys-directory "/var/named/dynamic";
 
@@ -60,13 +62,21 @@ include "/etc/named.rfc1912.zones";
 include "/etc/named.root.key";
 
 //forward zone
-zone "{{ env.cluster.networking.base_domain }}" IN {
+zone "{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}" IN {
      type master;
      file "/var/named/{{ env.cluster.networking.metadata_name }}.db";
      allow-update { any; };
      allow-query { any; };
 };
 
+{% if env.bastion.networking.nameserver2 is defined %}
+// forwared zone
+zone "{{ env.cluster.networking.base_domain }}" IN {
+     type forward;
+     forwarders { {{ env.bastion.networking.nameserver2}} };
+};
+{% endif %}
+
 //backward zone
 zone "{{ bastion_split_ip.2 }}.{{ bastion_split_ip.1 }}.{{ bastion_split_ip.0 }}.in-addr.arpa" IN {
      type master;

roles/dns/templates/dns.db.j2

@@ -8,7 +8,7 @@ $TTL 86400
 )
 
 ;Name Server / Bastion Information
-@ IN NS {{ env.bastion.networking.hostname }}.{{ env.bastion.networking.base_domain }}.
+{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}. IN NS {{ env.bastion.networking.hostname }}.{{ env.bastion.networking.base_domain }}.
 
 ;IP Address for Name Server
 {{ env.bastion.networking.hostname }} IN A {% if env.bastion.networking.internal_ip is defined and env.bastion.networking.internal_ip!=None %}{{ env.bastion.networking.internal_ip }}{% else %}{{ env.bastion.networking.ip }}{% endif %}
@@ -23,12 +23,12 @@ $TTL 86400
 ;entries for the compute nodes
 
 ;The api identifies the IP of your load balancer.
-api.{{ env.cluster.networking.metadata_name }}     IN    CNAME {{ env.bastion.networking.hostname }}.{{ env.cluster.networking.base_domain }}.
-api-int.{{ env.cluster.networking.metadata_name }} IN    CNAME {{ env.bastion.networking.hostname }}.{{ env.cluster.networking.base_domain }}.
+api.{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}.     IN    A {{ env.bastion.networking.ip }}
+api-int.{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}. IN    A {{ env.bastion.networking.ip }}
 
 ;The wildcard also identifies the load balancer.
-apps.{{ env.cluster.networking.metadata_name }}  IN    CNAME {{ env.bastion.networking.hostname }}.{{ env.cluster.networking.base_domain }}.
-*.apps.{{ env.cluster.networking.metadata_name }}  IN    CNAME {{ env.bastion.networking.hostname }}.{{ env.cluster.networking.base_domain }}.
+apps.{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}.     IN    A {{ env.bastion.networking.ip }}
+*.apps.{{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}.   IN    A {{ env.bastion.networking.ip }}
 
 {% if disconnected.enabled %}
 ;entry for mirror host.

roles/dns/templates/resolv.conf.j2

@@ -1,3 +1,4 @@
-search {{ env.cluster.networking.base_domain }}
-nameserver {{ env.bastion.networking.nameserver1 }}
-{{ ('nameserver ' + env.bastion.networking.nameserver2) if env.bastion.networking.nameserver2 is defined else '' }}
+search {{ env.cluster.networking.metadata_name }}.{{ env.cluster.networking.base_domain }}
+nameserver {{ env.cluster.networking.nameserver1 }}
+{{ ('search ' + env.cluster.networking.base_domain) if env.cluster.networking.nameserver2 is defined else '' }}
+{{ ('nameserver ' + env.cluster.networking.nameserver2) if env.cluster.networking.nameserver2 is defined else '' }}