You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "sudo87 (via GitHub)" <gi...@apache.org> on 2026/08/18 11:49:05 UTC

[I] Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers [cloudstack]

sudo87 opened a new issue, #13911:
URL: https://github.com/apache/cloudstack/issues/13911

   ### The required feature described as a wish
   
   Currently, a DNS server can only be set up for the calling account/domain, there is no way for a root admin to configure one on behalf of a different account or domain, and no way for a DNS server to belong to a project.
   
   As a root admin, I would like to be able to:
   
   1. Set up a DNS server on behalf of a specific user/account
   2. Set up a DNS server on behalf of a specific domain
   3. Attach a DNS server to a project
   
   Additional constraint:
   
   4. If a DNS server was set up by root admin on behalf of a user/domain, that user/domain should not be able to modify its URL themselves. Only root admin (or whoever provisioned it) should be able to change it.
   
   Motivation:
   
   Asks 1 and 2 are primarily driven by the recent restriction that only root admin can configure a DNS server on a private/internal (RFC1918) address, domain admins and regular users can no longer do so directly (see [PR #13821](https://github.com/apache/cloudstack/pull/13821/commits/1545adde35dd68a90291687fc3f7cec23b1e13f6)). Without a way for root admin to provision such a server on behalf of another account/domain, that use case is lost entirely for non-root-admin users.
   
   Ask 3 (project support) wasn't part of the initial scope for this feature. It's being tracked here as a follow-up enhancement rather than a gap in the original design.
   
   Ask 4 follows directly from 1 and 2: if the owning user/domain could freely change the URL afterward, they could redirect an admin-provisioned DNS server anywhere they like, defeating the purpose of restricting private-address setup to root admin in the first place.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers [cloudstack]

Posted by "RosiKyu (via GitHub)" <gi...@apache.org>.
RosiKyu commented on issue #13911:
URL: https://github.com/apache/cloudstack/issues/13911#issuecomment-5914519932

   @sudo87 do you plan to create a PR to address this in 24.0?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers [cloudstack]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13911:
URL: https://github.com/apache/cloudstack/issues/13911#issuecomment-5396256098

   ## ๐ŸŽฏ Triage report
   
   Requests that root admins be able to configure DNS servers on behalf of another account/domain (not just their own), and for DNS servers to optionally be scoped to a project, with a constraint that admin-provisioned DNS servers can't have their URL changed by the target account/domain. Motivated by a recent restriction (PR #13821) limiting private-address DNS server configuration to root admin only, which otherwise removes this capability entirely for non-root-admin users.
   
   ### ๐Ÿ“Š Assessment
   
   | Dimension | Value | Reasoning |
   |---|---|---|
   | **Type** | type:new-feature | Adds new capability (cross-account/domain provisioning, project scoping) not previously possible |
   | **Component** | component:networking | DNS server configuration is a networking feature |
   | **Severity** | n/a | Not a bug |
   | **Labels** | type:new-feature, component:networking | |
   | **Coding agent** | Needs more info | Clear motivation and constraints (1-4) are given, but API parameter/permission design and exact enforcement points aren't specified โ€” needs a design pass before implementation |
   
   ### ๐Ÿ”— Similar issues
   
   No similar open issues found. (References PR #13821 as related prior work that created the need for this feature.)
   
   <details><summary>๐Ÿ’ก Notes and suggestions</summary>
   
   Consider whether this should be scoped as one FS (for account/domain provisioning) with project support tracked as a separate, smaller follow-up enhancement, as the issue itself notes project support wasn't part of the original design scope.
   
   </details>
   
   
   
   > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/32734226944) ยท sonnet50 233.4K ยท [โ—ท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues)
   >
   <details>
   <summary>Add this agentic workflows to your repo</summary>
   
   To install this agentic workflow, run
   
   ```
   gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
   ```
   </details>
   
   
   <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 32734226944, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/32734226944 -->
   <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage -->


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Allow root admin to configure DNS servers on behalf of a specific user/domain and support project-scoped DNS servers [cloudstack]

Posted by "sudo87 (via GitHub)" <gi...@apache.org>.
sudo87 commented on issue #13911:
URL: https://github.com/apache/cloudstack/issues/13911#issuecomment-5924538598

   @RosiKyu not for 24.0, it will be considered for next release. There are still some questions to clarify, such as; is it alright to share credentials of DNS server with the root admin. That seems bigger security risk to me. cc: @weizhouapache 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org