{"id":24302977,"url":"https://github.com/tmeckel/aci-dns-manager","last_synced_at":"2025-09-26T06:30:53.713Z","repository":{"id":64318639,"uuid":"427704311","full_name":"tmeckel/aci-dns-manager","owner":"tmeckel","description":"DNS Manager for Azure Container Instances","archived":false,"fork":false,"pushed_at":"2023-12-18T23:01:36.000Z","size":64,"stargazers_count":7,"open_issues_count":2,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-06-21T18:54:04.787Z","etag":null,"topics":["azure","container","container-instances","containerization","containers","docker"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tmeckel.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-11-13T15:39:38.000Z","updated_at":"2023-11-02T22:43:59.000Z","dependencies_parsed_at":"2024-03-17T06:05:58.300Z","dependency_job_id":"6b2bdad3-9bd1-4ce1-bc17-4ce4c8bb1310","html_url":"https://github.com/tmeckel/aci-dns-manager","commit_stats":null,"previous_names":["tmeckel/aci-dns-updater"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tmeckel%2Faci-dns-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tmeckel%2Faci-dns-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tmeckel%2Faci-dns-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tmeckel%2Faci-dns-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tmeckel","download_url":"https://codeload.github.com/tmeckel/aci-dns-manager/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234296370,"owners_count":18809988,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","container","container-instances","containerization","containers","docker"],"created_at":"2025-01-17T00:33:22.901Z","updated_at":"2025-09-26T06:30:48.393Z","avatar_url":"https://github.com/tmeckel.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Container Instances DNS Record Manager\n\n## Introduction\n\nAzure Container Instances (ACI) are a great way to run Docker Images in a\nmanaged environment with little configuration effort, without the need to deploy\na Container runtime like Docker or, even bigger, a Kubernetes Cluster. Despite the\nease-of-use ACI has some annoying issues, especially when bound to a private\nvirtual network.\n\nOne of these annoyances is the fact that an ACI instance, which is connected to\nprivate virtual network, does not propagate a DNS name (FQDN). This is even more\nproblematic because ACI does not support a static IP address and thus an ACI\nmight be bound to a different IP address after a restart.\n\nThis repository contains a program (`aci-dns-manager`) which will ensure that a\nDNS A-Record is created for an ACI instance, in a startup container, side car or\nduring the startup code (script) of the deployed container.\n\n\u003e\n\u003e Note\n\u003e Currently only Private DNS Zones are supported\n\u003e\n\n## How to use\n\n### Authentication\n\nWith ACI (theoretically) two types of principals can be used with\n`aci-dns-manager` to authenticate towards the Azure REST API:\n\n- Managed Identity\n- Service Principal\n\nUnfortunately ACI only supports Managed Identities only when the ACI is **not**\nconnected to a private virtual network.\n\nRef: https://docs.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity#limitations\n\nDue to this, the only way that `aci-dns-manager` can authenticate at the Azure\nREST API is using a service principal. The following environment variables must\nbe specified to enable `aci-dns-manager` to use a service principal for\nauthentication:\n\n- `AZURE_CLIENT_ID`\n- `AZURE_CLIENT_SECRET`\n- `AZURE_TENANT_ID`\n\nFor additional details refer to chapter [configuration](#configuration)\n\n### Security considerations\n\nEven if an own ACI deployment is trustworthy, the permissions of the\n`aci-dns-manager` should be narrowed down to the permissions really required to\ncreate (update, delete respectively) the DNS record for the connected ACI.\n\nThe ideal way to do this is to use a custom RBAC role definition in Azure, which\nwill then assigned to the principal the `aci-dns-manager` will use to authenticate\ntowards the Azure REST API.\n\nAn example of such a custom role definition could be the following:\n\n```json\n{\n    \"Name\": \"Private DNS A-Record Writer\",\n    \"Description\": \"Can read, write DNS A and AAAA records\",\n    \"AssignableScopes\": [\n        \"/subscriptions/{subscriptionId1}\"\n    ],\n    \"Actions\": [\n        \"Microsoft.Network/privateDnsZones/A/read\",\n        \"Microsoft.Network/privateDnsZones/A/write\",\n        \"Microsoft.Network/privateDnsZones/read\",\n        \"Microsoft.Network/privateDnsZones/AAAA/read\",\n        \"Microsoft.Network/privateDnsZones/AAAA/write\",\n        \"Microsoft.Network/privateDnsOperationResults/read\",\n        \"Microsoft.Network/privateDnsOperationStatuses/read\"\n    ],\n    \"NotActions\": [],\n    \"DataActions\": [],\n    \"NotDataActions\": []\n}\n```\n\nTo allow the deletion of A and AAAA records, e.g. while deprovisioning an ACI, the\nfollowing `Actions` must be added to the above shown Role Definition\n\n```text\n\"Microsoft.Network/privateDnsZones/A/delete\",\n\"Microsoft.Network/privateDnsZones/AAAA/delete\"\n```\n\nIf the above Role is assigned to a Azure DNS Private Zone resource, the\n`aci-dns-manager` could change, or even delete, arbitrary DNS records therein. To\nmitigate this risk of inadvertently changing DNS entries by `aci-dns-manager`,\nthe above role should be assigned to a pre-created DNS entry. In that case\n`aci-dns-manager` can only change it's \"own\" DNS record. What is definitely the\npreferred way to go.\n\n### Configuration\n\nThe program is configured via various environment variables\n\n| Variable                            | Description                                                                                                                                                                                                                                                                                                                    | Required                                      |\n| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- |\n| `ARM_SUBSCRIPTION_ID`               | The Azure subscription of the ACI                                                                                                                                                                                                                                                                                              | yes                                           |\n| `ACI_RESOURCE_GROUP_NAME`           | The resource group in which the ACI is deployed                                                                                                                                                                                                                                                                                | yes                                           |\n| `DNS_ZONE_NAME`                     | The name of the DNS zone in which the A record shall be created                                                                                                                                                                                                                                                                | yes                                           |\n| `AZURE_TENANT_ID`                   | The id (guid) of the Azure Tenant in which the service principal is located used for authentication                                                                                                                                                                                                                            | no, required if: AZURE_CLIENT_ID is specified |\n| `AZURE_CLIENT_ID`                   | The id (guid) of the service principal used for authentication                                                                                                                                                                                                                                                                 | no                                            |\n| `AZURE_CLIENT_SECRET`               | The secret (password) of the service principal used for authentication                                                                                                                                                                                                                                                         | no, required if: AZURE_CLIENT_ID is specified |\n| `ACI_INSTANCE_NAME`                 | The name of the ACI for which a a DNS A record shall be created. \u003cbr /\u003e If not specified the environment variable `Fabric_CodePackageName` will be used. \u003cbr /\u003e However, it was found that the ACI runtime does not reliably set this variable. So to prevent any errors the `ACI_INSTANCE_NAME` variable should always be set | no, if `Fabric_CodePackageName` is used       |\n| `ACI_MAX_RETRY`                     | Number of retries to get deployment information (IP address) of the configured ACI                                                                                                                                                                                                                                             | no, default: `10`                             |\n| `ACI_TIMEOUT`                       | How long to wait between retries                                                                                                                                                                                                                                                                                               | no, default: `10` seconds                     |\n| `DNS_ZONE_RESOURCE_GROUP_NAME`      | The resource group of the private DNS Zone                                                                                                                                                                                                                                                                                     | no, default: `ACI_RESOURCE_GROUP_NAME`        |\n| `DNS_ZONE_RESOURCE_SUBSCRIPTION_ID` | If the private DNS zone is located in a different subscription than the ACI instance, this variable contains the Id (guid) of this subscription.                                                                                                                                                                               | no, default `ARM_SUBSCRIPTION_ID`             |\n| `DNS_A_RECORD_NAME`                 | The name of the DNS A record to create.                                                                                                                                                                                                                                                                                        | no, default `container name`                  |\n| `DNS_A_RECORD_TTL`                  | The TTL value of the DNS A record                                                                                                                                                                                                                                                                                              | no, default `3600`                            |\n| `ARM_TRACE`                         | If this environment variable is set (any value), trace messages will be created during communication with the Azure REST API. Valuable for troubleshooting.                                                                                                                                                                    | no                                            |\n\n### Examples\n\nThe following examples are provided to show the usage of `aci-dns-manager`:\n\n1. Scenario: `S6-Init`\n\n    The `S6-Init` system will execute `aci-dns-manager` inside an init script.\n    Details can be found in [README](example/s6/README.md)\n\n2. Scenario: ACI Init Container\n\n   `aci-dns-manager` will be run in an Init container defined in the YAML file which describes the ACI.\n   Details can be found in [README](example/init/README.md)\n\n## Resources\n\nThe repository will provider the following type of ways to download `aci-dns-manager`\n\n- `Docker Image`\n- `TAR archive`\n\nPlease refer to the [release section](releases) to find the latest versions.\n\n## Links\n\nhttps://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#section-readme  \nhttps://docs.microsoft.com/en-us/azure/developer/go/manage-resource-groups?tabs=bash%2Cazure-portal  \nhttps://docs.microsoft.com/en-us/azure/developer/go/management-libraries#long-running-operations  \nhttps://kreuzwerker.de/en/post/managing-multi-process-applications-in-containers-using-s6  \nhttps://tutumcloud.wordpress.com/2015/05/20/s6-made-easy-with-the-s6-overlay/  \nhttps://docs.microsoft.com/ms-my/azure/service-fabric/service-fabric-environment-variables-reference  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftmeckel%2Faci-dns-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftmeckel%2Faci-dns-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftmeckel%2Faci-dns-manager/lists"}