Is it worth creating a GitHub issue for FQDN support in Address Sets and ACLs? I understand why it might be troublesome, but I have the following use case:
Multiple standalone Incus servers with almost all config kept in sync via OpenTofu. The only real difference is the network addresses. All networks use the same forward DNS zone, and AXFRs are merged on a central authoritative DNS server.
With this setup, I can easily migrate a container from Lisbon to Warsaw and still access it using the same FQDN across all my networks.
The problem arises when I use ACLs because they support only IP addresses, which change after migration.
Of course, I could script it and push an update to the ACL via OpenTofu, but it would be a very ugly hack — though I will do that if achieving it inside Incus isn’t possible.
On another note it would be cool to be able to set acl with a container name as a source or destination for a single incus server deployment.
Adding DNS resolution to address sets would likely get a bit messy as it’s not unusual at all for DNS or routers to be running on Incus itself, potentially causing a bit of a chicken and egg problem if we need to start resolving this stuff on startup. We also would need some kind of periodic update of some kind to pull the new value, and then also deal with all the fun of round-robin records, multi-family records, CNAMEs, … It’s a headache I’m hoping not to have to deal with for a little while
It also sounds like you’d want to use Incus generated DNS records rather than just external records that Incus can resolve on start. That actually makes it even worse as Incus wouldn’t be able to expand the entire address set on startup or on set update, instead it will have a bunch of things that will fail to resolve until they are started and pick up an address from DHCP, causing the record to now appear…
I’m also guessing you’re not using IPv6 for any of this as otherwise you could use the fact that SLAAC addresses are predictable and so could generate all your ACLs to include each of the potential addresses (one per site).
I get what you mean by a headache, I kinda expected that.
My DNS periodically pull multiple axfr’s into a single Pirimary zone file, with some clever replacement and sanitation of records. The zone is also replicated to another server that is not hosted on Incus itself. So records are actually always there even if source Incus server is down.
I actually considered going full ipv6 ditching ipv4 but some applications unfortunately still need it. so it was a dead end for now, It also would be problematic if I would remove an instance then create different one with the same name.
Anyway, thanks for even considering this subject. I will script something that will do zone transfer then generate OpenTofu .tf files that will create/replace/remove address-sets from A/AAAA records. I will share it here.
