How to set tenant on managed record

[jhofmueller]

Hi!

We are planning to move our entire DNS to netbox and use netbox-dns to manage everything. We have the need to allow certain people to alter records for their respective department. In order not to expose the entire DNS to everyone we thought about creating permissions with constraints that only allow people to alter records that "belong" to them/their department.
We also want to use ipam_coupling since it seems quite obvious for us. Now we face the problem that when one creates an ipaddress and assigns it a tenant (or it inherits the tenant from the prefix it belongs to) this information is NOT passed on to the DNS records and (see below) since they are managed records we cannot add the information manually.
Is there something we forgot to configure? Does anyone have an idea how that could be achieved?
As @peteeckel writes here: "Tenancy can be added to all models. The only notable exception are managed records that can't actually be edited manually. I could make them inherit tenancy from their associated address records (in the case of PTR records) or the zone they belong to (in the case of SOA or NS records), but I'm not sure if that makes sense.". This does not seem to be implemented. For us it would be really useful if records could inherit tenancy from the address object they belong to.

Regards,
j.

[peteeckel]

Currently you can't change anything about managed record, which includes tenancy.

Please do not make any critical workflow depend on the IPAM Coupling feature. It is still experimental and will change substantially in the future.

That said, nothing prevents you from running a custom script on the NetBox DNS data that adds tenancy for managed records, and NetBox DNS itself doesn't do anything with tenancy at all.

I could even imagine copying the tenant_id field from certain records to managed records - i.e. from an address record to it's associated PTR record, or from an IP address to the coupled address and PTR record. The issue with this - and the reason why it's not done currently - is that it strongly depends on individual workflows and cannot easily be generalised or made so flexible that it covers all use cases.

For cases like this one I always recommend a custom script in addition with an event rule - every time an IP address is changed, check for the associated address and PTR records (it's a bit more complex when you're using RFC2317 zones, but it can be done as well), and copy the tenant_id of the IP address to the corresponding fields of the generated managed records. Do you think that could solve your problem?

If you have a little time I could also provide a sample implementation of such a script.

[jhofmueller]

Something like that sounds like a solution. A sample implementation would be greatly appreciated 😎

[peteeckel]

You can start out with the following code:

#!/usr/bin/env python3

from extras.scripts import Script
from ipam.models import IPAddress

from netbox_dns.models import Record, RecordTypeChoices

name = "NetBox DNS Tenancy Synchronizer"


class RecordTenancySynchronizer(Script):
    class Meta:
        name = "Record Tenancy Synchronizer"
        description = "Set the tenant for a PTR record from its address record"
        commit_default = True

    def run(self, data, commit):
        self.log_info("Record Tenancy Synchronizer started")

        if (pk := data.get("id")) is None:
            return

        record = Record.objects.get(pk=pk)
        if record.is_address_record:
            if (ptr_record := record.ptr_record) is not None and ptr_record.tenant != record.tenant:
                self.log_info(f"Setting tenant for record {ptr_record} to {record.tenant}")
                ptr_record.tenant = record.tenant
                ptr_record.save()

        self.log_info("Record Tenancy Synchronizer done")


class IPAddressTenancySynchronizer(Script):
    class Meta:
        name = "IP Address Tenancy Synchronizer"
        description = "Set the tenant for an IPAM coupled address record from its IP address"
        commit_default = True

    def run(self, data, commit):
        self.log_info("IP Address Tenancy Synchronizer started")

        if (pk := data.get("id")) is None:
            return

        ip_address = IPAddress.objects.get(pk=pk)
        tenant = ip_address.tenant
        for address_record in ip_address.netbox_dns_records.all():
            if address_record.tenant != tenant:
                self.log_info(f"Setting tenant for record {address_record} to {tenant}")
                address_record.tenant = tenant
                address_record.save()

            if (ptr_record := address_record.ptr_record) is not None and ptr_record.tenant != tenant:
                self.log_info(f"Setting tenant for record {ptr_record} to {tenant}")
                ptr_record.tenant = tenant
                ptr_record.save()

        self.log_info("IP Address Tenancy Synchronizer done")

This provides you with two custom scripts: One sets a PTR record's tenant to the tenant of the associated address record, and the other one does the same for address records and PTR records created from IP addresses by IPAM Coupling.

After installing the custom scripts you need to define event rules: One for create/update of IPAM IPAddress objects, and the other one for create/update of NetBox DNS Record objects, with the IPAddressTenancySynchronizer and RecordTenancySynchronizer script as the action to trigger. It makes sense to also define conditions that limit the cases in which the scripts are actually triggerd, for IPAddress this would be the custom field mapping it to a DNS Record, for Record you should limit execution to type in ("A", "AAAA") and disable_ptr = False, or probably even better for ptr_record is not None. You'll find out how to do that - it's not strictly necessary, though, it can just improve performance substantially.

That should get you started for your use case.

[jhofmueller]

This looks great! Thanks a lot. It will take some days to take a closer look but I will get back to you with more feedback!

[peteeckel]

Hi @jhofmueller, I also added the custom script example and provided some documentation in the feature/netbox-4 branch, and added a small fix to both the main branch and the feature/netbox-4 branch to make the tenant show up in the detail view for managed records, which was not the case before.

While I won't backport the documentation and the example script to the main branch (which will soon be moved to legacy and replaced by the current feature/netbox-4 branch anyway), the example and the documentation should largely work with the current 0.22 release.

Thanks for the idea, I hope others will find that example and the additional information useful as well.