Software deployment

Before you begin

Deployment overview

Node role	Required	Function	Hybrid deployment	Number of nodes	Network requirements
control proxy service	Yes	Synchronizes configurations between On-premises DNS and the Alibaba Cloud DNS console, and distributes them to other resolution nodes. At least one control proxy service is required per resolution cluster. Supports multi-node deployment. The system automatically builds a high availability cluster and elects a primary control proxy to communicate with the Alibaba Cloud DNS console.	Yes. You can deploy this service on the same host as the resolution service.	Multiple nodes in a single resolution cluster automatically form a Raft cluster and elect a primary node: 3 nodes (recommended) 1 node (minimum)	The control proxy service and Log Service nodes must access the domain name alidns-cloud-endpoint.aliyuncs.com over the public network on port 443. The control proxy, resolution, and Log Service nodes require bidirectional TCP communication on the following ports: 9090, 9000, 29100, 7677, 6666, 7777, 7676, 7675, 6667, and 7776. Port 53 (TCP/UDP) must be open on resolution nodes to provide external DNS resolution.
resolution service	Yes	Provides built-in services for authoritative resolution, forwarding, and recursion.	Yes. You can deploy this service on the same host as the control proxy service.	You can configure primary and secondary DNS through a load balancing device or at the client: 2 nodes (recommended) 1 node
Log Service	Yes	Collects resolution logs, alert logs, and alert notifications from resolution nodes and syncs them to the Alibaba Cloud DNS console for display.	No. Only standalone deployment is supported.	Multiple nodes automatically form a Raft cluster and elect a primary node: 3 nodes (recommended) 1 node (minimum)

Important

Dedicate each host to the On-premises DNS service. Do not deploy other services on the same host.
For host specifications and operating system requirements, see Deployment environment limitations.

Common deployment scenarios (single resolution cluster)

In a production environment, deploy multiple nodes for the resolution service to ensure high availability. Otherwise, subsequent upgrades may interrupt the resolution service. For more information, see Upgrade.

POC environment

Hybrid control and resolution deployment

Deployment plan: Deploy the control proxy service and resolution service in a hybrid configuration on a single host. Deploy Log Service on a separate host.

Network requirements: All nodes must have public network access to alidns-cloud-endpoint.aliyuncs.com on port 443.

Use case: Testing product functionality.

Benefits: This fast and cost-effective deployment lets you test all features on just two hosts.

Trade-offs: This architecture provides neither high availability nor disaster recovery and exposes the resolution nodes to the public network.

Production (full access)

Hybrid deployment with node failover

Deployment plan: Deploy two hybrid instances, each running both the control proxy service and the resolution service. Deploy one additional standalone control proxy service node. Deploy Log Service on a separate host.

Network requirements: All nodes must have public network access to alidns-cloud-endpoint.aliyuncs.com on port 443.

Use case: Production environments that require high availability.

Benefits: With only four hosts, you get full feature access and high availability for both the control proxy service and resolution service:

If one control proxy service fails, the cluster elects a new primary node. Configuration distribution and the resolution service are not affected.
If two control proxy services fail, new configuration data from the cloud cannot be distributed to the resolution service. However, previously configured resolution rules remain effective.
You can use a Server Load Balancer (SLB) device to achieve high availability for the resolution service. If you have a high volume of resolution requests, you can seamlessly scale out resolution service nodes.

Trade-offs: The resolution service nodes expose public IP addresses, making them vulnerable to attacks.

Production (partial access)

Deployment plan: Deploy the control proxy service and resolution service on separate hosts. Deploy three control proxy service nodes to form a high-availability architecture. Deploy the resolution service on n additional, separate hosts. Deploy Log Service on another separate host.

Network requirements: Only the hosts for the control proxy service and Log Service require public network access to alidns-cloud-endpoint.aliyuncs.com on port 443. The hosts for the resolution service operate entirely within a private network.

Use case: Environments that require high availability, support high query volumes, and must keep resolution services isolated from the public network.

Benefits:

If a host running the control proxy service fails, the cluster elects a new primary node. Configuration distribution and the resolution service are not affected.
If two hosts running the control proxy service fail, the resolution service is not affected. However, new configuration data from the cloud cannot be distributed to the resolution service. Previously configured resolution rules remain effective.
You can use a Server Load Balancer (SLB) device to achieve high availability for the resolution service. For scenarios with high query volumes, you can seamlessly scale out resolution service nodes.
The resolution service nodes are completely isolated within the private network for enhanced security and control.

Trade-offs: This architecture requires more server resources.

Deployment workflow

Service deployment sequence

Important

You must first deploy a control proxy service in each resolution cluster, or deploy a node that includes the control proxy service in a hybrid deployment.
In each resolution cluster, deploy the resolution service only after the control proxy service is deployed. The cluster provides DNS resolution services only after both components are deployed.
After you deploy Log Service, you must attach it to a resolution cluster to collect logs and alerts from that cluster. You can associate a single Log Service cluster with multiple resolution clusters to collect their logs and alerts.

Software deployment sequence

Important

When deploying nodes that run the control proxy service or Log Service, you must establish the cloud-edge connection during the agent installation step.
Nodes that run only the resolution service do not require a cloud-edge connection.

Procedure

Step 1: Enable service

Log in to the Alibaba Cloud DNS console.
In the left-side navigation pane, click On-premises DNS, and then click Enable.
In the dialog box that appears, click Activate, and then click Buy Now.

Important
This action only activates the service for future use. You are not charged if you do not configure any services. For information about billing, see Product billing.
After the service is enabled, on the On-premises DNS page, click Deploy.

Step 2: Install agent

Important

If an environment check fails or a deployment error occurs while installing the agent, resolve the issues based on the provided suggestions. After the issues are fixed, run the./aui command in the /home/alidns/tui/alidns-tui-install directory to restart the agent and its configuration.

Use an SSH tool, such as Xshell, PuTTY, OPENSSH, or SecureCRT, to connect to the host as the root user.
On the deployment page, copy the installation command. Run the command in the host terminal. Supported operating systems include Alibaba Cloud Linux, Anolis 8, and CentOS 7.

After the command runs successfully, click Start Installation in the TUI.

___               /\_\                /\_\
     /\_ \    __        \/_/    ___ ___     \/_/_
  __ \//\ \  /\_\  __  __     /\ \/\ \  ___    ___
 /\_\  \ \ \ \/\ \/\ \/\ \   /\ \_\ \ \/\ \  /\ \/\_\
/\ \L\_ \_\ \_\ \ \ \_\ \_\ /\ \__/\ \_\ \ \ \/\ \/\_\
\ \__/./\____\\ \_\ \___,__\\ \/_/  \/_/  \ \_\ \_\/\_\
 \/__/ \/____/ \/_/\/__,_ /               \/_/\/_/\/_/
            Alibaba Cloud DNS Installer v1.0.0
       This tool installs the agent for Alibaba Cloud On-premises DNS.
       After installation, you can configure the resolution service 
       for On-premises DNS in the Alibaba Cloud DNS console.
        Click 'Start Installation' or press Enter to begin.
            ┌────────────────────┐
            │ Start Installation │
            └────────────────────┘

Environment check: The installer checks the host's CPU, memory, disk, and critical service ports. The installation continues only if all checks pass. If a check fails, the installation stops. You must resolve the reported issues before reinstalling.

Hotkeys: Previous Next <ctrl-c> Exit
Deployment Steps
1 Environment Check
2 Install Agent
3 Establish Cloud-Edge Connection
Item            Requirement              Result
CPU (cores)     ≥ 2 cores                ✓
Memory          ≥ 8 GB                   ✓
Disk (/home)    ≥ 32 GB                  ✓
OS              centos[7],alibaba[2...]  ✓
SELinux         Disabled                 ✓
Docker          Not third-party          ✓
Service Port    Not in use               ✓
Step Description
To ensure the agent for Alibaba Cloud On-premises DNS is installed successfully, the installer checks the host's CPU, memory, disk, and critical service ports. The installation continues only if all checks pass. If a check fails, the installation stops. Please resolve any reported issues and meet the requirements before reinstalling.
Output
CPU cores: 8
Available memory: 14 GB
Available disk space in /home: 90 GB
OS version: centos7.9.2009
SELinux is disabled
docker (19.03.15) is installed; skipping
Service ports are not in use
Environment check passed. Select Next to start installing opAgent.
Fix

Install agent: The agent is a cloud control channel proxy. It deploys node services, forwards instructions from the Alibaba Cloud DNS console to the control proxy and Log Service components, and distributes configuration data from the control proxy service to the resolution service.

Hotkeys: [↑] Previous [↓] Next <ctrl-c> Exit
Deployment Steps                            Action
1 Environment Check                         (1) Check current Docker version
2 Install Agent                             (2) Start container ops-nodeexporter
3 Establish Cloud-Edge Connection           (3) Start container ops-opagent
Step Description
Install the agent component. The agent runs as a container. Docker is
installed automatically during this process. If a different version of Docker
is already installed, the installation stops. Please uninstall it before
installing the agent.
                                            Output
                                            docker (19.03.15) is installed; skipping
                                            Container ops-nodeexporter started successfully from image ops-nodeexporter:test
                                            Container ops-opagent started successfully from image ops-opagent:test
                                            Agent installed. If this is a control node, proceed to the next step.
                                            Fix

Establish cloud-edge connection: This step creates a communication channel between the local agent and the cloud services, and registers the user identity by using an AK/SK pair. After this connection is established, you can configure the On-premises DNS resolution service in the Alibaba Cloud DNS console. In the connection interface, enter the cluster ID, AK/SK, communication IP, and other parameters, and then click Connect.
Important
- When you deploy nodes that run the control proxy service or Log Service, you must provide the cluster ID, your Alibaba Cloud AK/SK, and the local communication IP.
- You can use the AK/SK of a RAM user, but the RAM user must have the AliyunDNSFullAccess management permission.
- Nodes that run only the resolution service do not require a cloud-edge connection.
- To obtain the AK/SK and cluster ID, see the "Install agent" step of the deployment guide on the On-premises DNS page in the console.
- The local communication IP, typically a private network IP, is used for communication between nodes. The system automatically detects the host's IP address. If you want to set a different IP, click Manually Enter Communication IP.
After the connection is established, return to the deployment progress page in the console and click Next.

Step 3: Configure node information

On the On-premises DNS page in the console, enter the required parameters and click Next.

Node Name: Enter a descriptive name for the node to help with identification and management.

Associated Cluster: By default, the system creates a resolution cluster and a Log Service cluster. You cannot delete these clusters, but you can rename them.

Cluster type	Service roles	Multi-cluster support
resolution cluster	control proxy service, resolution service	Yes. In multi-office scenarios, you can create a new resolution cluster for each office location.
Log Service cluster	Log Service	No. You can associate a single Log Service cluster with multiple resolution clusters.

Node Service Role: The first node in a resolution cluster must have the control proxy service deployed. It can be deployed in a hybrid configuration with the resolution service. Deploy Log Service last.

Local communication address between nodes: This IP address, typically a private network IP, is used for communication between the current node and all control proxy service nodes. Ensure that all nodes use the same IP address type (all private network IPs or all public network IPs).

Deploy Software Versions: You can only select the currently deployed version or the latest version. A cluster can contain nodes with different versions.

Remarks: Enter remarks for the node to aid operations and maintenance.

Step 4: Deploy software

After you configure the basic information in Step 3, click Next. Then, on the deployment progress page, click Start Deployment.
After the control proxy service, resolution service, and Log Service are deployed, you can attach a log service cluster in the Alibaba Cloud DNS console to configure private zone resolution. For more information about Log Service, see On-premises DNS resolution logs.