Support External Routing and DNS Integration

[dsjodin]

Is your feature request related to a problem? Please describe.

Yes. In our virtualized lab, we use VyOS as our main router and a centralized DNS for all internal networks.
Currently, Holodeck 9’s Holorouter uses its own internal FRR and DNS, which are isolated from the external lab environment.
This makes it difficult to route traffic or resolve DNS names between the main lab and the nested Holodeck environment.

Describe the solution you'd like

Add support for integrating Holodeck 9 with external routing and DNS systems.

Specifically:

• Allow replacing or peering the internal FRR (Holorouter) with an external router VM (e.g., VyOS) using BGP, OSPF, or static routes.

• Allow using an external DNS server or enabling zone transfers / forwarders between Holorouter DNS and external DNS.

This would enable seamless routing and name resolution between the lab and the Holodeck 9 environment.

Describe alternatives you've considered

No response

Additional context

We’d like to connect the Holodeck 9 environment to our lab’s existing VyOS-based network and DNS infrastructure.
This would allow full end-to-end integration, more realistic testing, and easier automation across environments.

[knikhilm]

You can peer FRR on holorouter with an external router today. Replace the below config snippet in /holodeck-runtime/frr/bgpRouterConfiguration.yaml with the config provided -

Replace

  router bgp 65000
   bgp router-id 10.1.6.1
   no bgp ebgp-requires-policy
   no bgp hard-administrative-reset
   no bgp graceful-restart notification
   bgp log-neighbor-changes
   !
   address-family ipv4 unicast
    redistribute connected
    import vrf sitea
   exit-address-family
  exit

with

  router bgp 65000
   bgp router-id 10.1.6.1
   no bgp ebgp-requires-policy
   no bgp hard-administrative-reset
   no bgp graceful-restart notification
   bgp log-neighbor-changes
   neighbor <remote-router-IP> remote-as <remote-router-AS>
   !
   address-family ipv4 unicast
    redistribute connected
    import vrf sitea
    neighbor <remote-router-IP> prefix-list ext99 out
   exit-address-family
   ip prefix-list ext99 seq 20 permit any
  exit

Then run kubectl apply -f /holodeck-runtime/frr/bgpRouterConfiguration.yaml and run kubectl rollout restart daemonset/frr-k8s

Note that ip prefix-list ext99 seq 20 permit any allows all prefixes. If you want to control what is shared, please modify it accordingly.

=====================================================================

For external DNS server, it is already allowed. The DNS Server that you configure for the holorouter is used as the upstream external DNS server for DNSMASQ running in Holorouter. If you are looking to integrate some other DNS server, edit the file /holodeck-runtime/dnsmasq/dnsmasq_configmap.yaml and modify the line server=<upstream_dns_server> in dnsmasq.conf section to reflect appropriate value. Then run kubectl apply -f /holodeck-runtime/dnsmasq/dnsmasq_configmap.yaml and then run kubectl delete -f /holodeck-runtime/dnsmasq/dnsmasq_deployment.yaml and kubectl apply -f /holodeck-runtime/dnsmasq/dnsmasq_deployment.yaml

[dsjodin]

hank you for the response, but I think there may be a misunderstanding about what I'm trying to accomplish.

What I have configured (and understand):

• dnsmasq uses my main lab DNS (10.1.10.10) as the upstream server
• Holodeck internal VMs can query dnsmasq and it forwards unknown queries to 10.1.10.10

What I'm trying to achieve (the opposite direction):
I need my main lab DNS server (at 10.1.10.10) to be able to query dnsmasq to resolve Holodeck hostnames (like sddcmanager-a.site-a.vcf.lab).

The Problem:
When I try to query dnsmasq from outside Holodeck (from my main lab network at 10.1.10.x), the queries time out. Even queries from the Holodeck host itself to dnsmasq at 10.2.1.1 fail.

What I've already tried:
I modified /holodeck-runtime/dnsmasq/dnsmasq_configmap.yaml to allow external queries:

dnsmasq.conf: |-
  expand-hosts
  listen-address=0.0.0.0
  log-queries
  domain=site-a.vcf.lab
  # ... rest of config

I also:

• Verified dnsmasq is listening on 0.0.0.0:53
• Added iptables rules to allow DNS traffic from 10.1.10.0/24
• Disabled reverse path filtering (rp_filter)
• Confirmed IP forwarding is enabled
• Verified BGP routing between networks is working

However:

• Queries from 10.1.10.1 to 10.2.1.1 port 53 still timeout
• dnsmasq logs show NO queries arriving from 10.1.10.x addresses (only from internal Holodeck IPs like 10.2.1.x)
• Even queries from the Holodeck host itself fail: nslookup sddcmanager-a.site-a.vcf.lab 10.2.1.1 times out

[knikhilm]

By default, holorouter dnsmasq listens for queries on all interfaces. So you can have your lab DNS server point to the VM management IP of the holorouter (eth0 IP on holorouter) for DNS resolution of Holodeck FQDNs. That should help you in what you're trying to achieve