Managing DNS zones under Continuous Integration

While working with BIND DNS zone files, I tend to use named-checkzone to act as a unit test to ensure that the zone files are valid. Rather than depend on the manual test that I run before deploying the zone files onto the server, I thought it would be nice if my CI server could automatically test and deploy them for me. The zone files are already version controlled in a Git repository.

The first thing needed is named-checkzone. It’s supplied with the Bind 9 package. If you are using Homebrew on OSX it can be installed with:

brew install bind

In this example, I use GNU Make to execute the tests. You could use another language, but Make seemed like a good fit for this.

export PATH := $(PATH):/usr/local/opt/bind/sbin/

zonefiles := $(wildcard db.*)
zones := $(foreach zonefile,$(zonefiles),$(subst db.,,$(zonefile)))

test: FORCE $(zonefiles)
  for zone in $(zones); do \
  	named-checkzone $$zone db.$$zone ; \
  done

FORCE:

The make file expects the zone files name to start with db. and then the domain that they define. When executed with make test it wil run named-checkzone across each of the zone files:

$ make test
for zone in example.domain.com; do \
	   named-checkzone $zone db.$zone ; \
  done
zone example.domain.com/IN: loaded serial 2015033101
OK

Success!

To finish the process off, I created a scripts directory and a test script which the CI server can execute to launch the test run:

make test

In a continuous deployment environment you could also create a deploy script which gets executed in the event that the tests pass. In the production environment I did this with I used Puppet with a vcsrepo resource type to deploy the repository.

There is a GitHub repository available with example code at github.com/aviancarrier/ci-zone-files.