Netlogon registers A records below _msdcs (gc._msdcs.<domain>), which the
default check-names of primary zones refuses; dynamic zones now get
check-names ignore. Troubleshooting for dcdiag in ACTIVE-DIRECTORY.md, an
end-to-end check of such an update.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A static address in a second network with domain ad.e2e.test reaches the
existing dynamic zone on the primary and, after the transfer, on the
secondary; after deleting it the name is gone while the records added by
nsupdate earlier stay.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An agent installed without token and enrolled with the command of the web
interface never ran as a service: the installer left the unit disabled and
the root-run enrollment left an identity the service user could not read.
The installer now always enables the agent unit (it waits for the
identity via ConditionPathExists), enroll as root hands the state over to
the service user and enables and starts the unit, and rerunning or
upgrading the installer repairs agents enrolled by hand. The web interface
shows the matching installer command next to the enroll command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the user's server the check reported "socket: permission denied" for
ping and asked only the server's own resolver. Ping now falls back to a
raw ICMP socket (the server unit gets CAP_NET_RAW, like /bin/ping); DNS
asks the DNS agents outside clusters when no name server addresses are
configured, gives every server its own timeout, and explains missing
records (dynamic zone, system resolver, not deployed yet).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Networks are created without pools; the e2e and installation tests assign
the old pool range with POST /networks/{id}/range and check that Kea gets
the pools around the reservation and that a dynamic entry resolves (A and
PTR). The lease step now expects the lease to update the existing dynamic
entry (MAC, lease_hostname) without renaming it. The benchmark assigns the
/16 DHCP test range at setup (65,521 dynamic entries, noted in the report);
the /21 data networks have no range any more.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Kea 3.x rejects clear-text users and passwords in HTTP authentication
("use of clear text 'user' is NOT SECURE"). Control socket clients now
use user-file and password-file, HA peers basic-auth-user-file and
basic-auth-password-file. The new secret artifact ddi-suite-ha-user
sits next to the password file (HAConfig.UserFile, set by derive);
keagen requires the file names ddi-suite-ha-password and
ddi-suite-ha-user. The DHCP agent handles both credential files alike:
consistent references in one directory, validation copy pointing at
the revision's files, written before the configuration, restored on a
failed reload, removed when HA goes away, compared by the health check.
Integration test and e2e read the user from the file; ADR 0023 updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A second BIND joins as secondary, a second Kea forms an HA pair. The test
checks zone transfers, records, updates by address and by TSIG key (and a
refused one), that revisions keep dynamic records, the HA state over the
authenticated control socket and the adoption of a lease as address.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The development and end-to-end named.conf include the TSIG keys file, which starts empty, so named starts before the first revision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New steps before the revoke step: /config/pending reports nothing after
revision 2 and the new address afterwards; the DHCP agent switched to
manual mode stays on revision 2 while the DNS agent reaches 3, and an
explicit push of revision 3 brings it there with a succeeded push
deployment; the diff of revision 3 contains the new host; rolling back
to revision 1 creates revision 4 with SOA serial 4 and without the later
names; /events announces a revision created while listening.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Docker Hub timed out on the shared runner; pulls now retry and fall back
to a local image. The e2e scripts were committed without the executable
bit. The truncation test checked letters that the marker itself contains.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
test/e2e runs server, PostgreSQL, BIND and Kea with both agents in
containers (make test-e2e, CI job End-to-end): enrollment with the
command from the API, revision 1 and 2 applied and served by BIND and
Kea, unchanged data creates no revision, revoking disconnects the agent
while BIND keeps serving.
Fixes from the first CI run: quote a spec description containing a
comma, exempt the agent lock-out routes in the route protection test,
whole-second certificate lifetimes, a push replacing queued pulls, the
truncation marker containing the letter checked, and curl|grep -q under
pipefail in the server smoke test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
