Cluster Catalog Overriding Manually Added Zone Transfer ACL and Notify IPs

[passibe15]

Hi,

I have a two-node cluster at site A and a standalone server at site B.
I want to share the zones of the cluster-catalog with site B.
On site A's primary node I added the IP of site B's server to the Zone Transfer ACL and the Notify "Specified Name Servers" under the cluster-catalog's options.
This works just fine, until at some point the primary node decides to remove the IP of site B's server from the ACL and the Notify "Specified Name Servers".
This leads to "Sync Failed" being displayed at site B and after some time "Expiry" until I manually add the IP again after which it works fine for some time but then again gets removed.

I guess this is due to the server at site B not being part of the cluster. But I don't want it to be, since it needs some different config in some respects, etc.

Therefore, could it be possible for the cluster "management" not to interfere with manually added IPs to the cluster-catalog's ACL/Notify options?

Note that this is not something new that came up with v15.3, but has been going on for as long as the clustering feature has existed. I just haven't had the time to report it yet.

Thanks!

[ShreyasZare]

Thanks for the post. This is actually a feature and the clustering code is supposed to maintain the cluster-catalog zone so that when nodes join or exit cluster, it is automatically maintained.

What you can do here is to use the "Zone Transfer Allowed Networks" and "Notify Allowed Networks" options in the Settings > General section instead of updating the cluster-catalog zone properties. These options are global and will make all zones work with it. That should solve the issue you have.

[passibe15]

Thanks for the quick response and the workaround!

The workaround solves the issue, but of course it would be nice to retain some granular control. I get that it's a feature because the cluster needs to manage access to the cluster-catalog zone, but it would still be nice to be able to add some IPs manually that "stick" and aren't modified by the cluster maintenance task. But for now I'm very happy with the workaround. Thanks again!

[ShreyasZare]

Thanks for the quick response and the workaround!

You're welcome. This is not really a workaround as its a proper feature to be used for such scenarios.

The workaround solves the issue, but of course it would be nice to retain some granular control. I get that it's a feature because the cluster needs to manage access to the cluster-catalog zone, but it would still be nice to be able to add some IPs manually that "stick" and aren't modified by the cluster maintenance task. But for now I'm very happy with the workaround. Thanks again!

Its not really feasible to allow making custom changes to cluster-catalog zone options. The cluster feature has to ensure that only cluster nodes are configured to work with it. The "Zone Transfer Allowed Networks" and "Notify Allowed Networks" options is a proper solution for such scenario and thus changing how clustering manages the zone is not really required.