designate — Interactions

Interactions with other components — designate — branch stable/2026.2

Branch stable/2026.2 @ e3dd774db145 — repository https://opendev.org/openstack/designate — analysed on 2026-10-29

Designate talks to six kinds of systems: its MariaDB/MySQL database (SQLAlchemy Core, no ORM), RabbitMQ (oslo.messaging RPC and notifications), a tooz coordination backend, the DNS protocol (to and from the DNS servers of each pool), the DNS servers' management APIs (one driver per pool target), and Keystone/Neutron (REST).

flowchart LR
  cli[Clients: OSC, Neutron, Heat, Skyline] -->|HTTPS REST /v2 /admin| api[designate-api]
  api -->|keystonemiddleware GET /v3/auth/tokens| ks[Keystone]
  api -->|AMQP call topic central| central[designate-central]
  central -->|SQL| db[(MariaDB)]
  central -->|AMQP cast topic worker| worker[designate-worker]
  central -->|REST GET /v2.0/floatingips| neutron[Neutron]
  central -->|tooz locks| coord[(tooz backend)]
  producer[designate-producer] -->|AMQP call/cast| central
  producer -->|AMQP cast| worker
  producer -->|tooz group producer| coord
  worker -->|AMQP cast update_status| central
  worker -->|backend driver: REST, rndc, WAPI| dns[(DNS servers of the pool)]
  worker -->|DNS NOTIFY, SOA queries UDP/TCP 53| dns
  dns -->|DNS AXFR TCP 5354| mdns[designate-mdns]
  mdns -->|SQL read| db
  masters[(external masters)] -->|DNS NOTIFY| mdns
  worker -->|DNS AXFR| masters
  nova[Nova] -->|AMQP notifications| sink[designate-sink]
  neutron -->|AMQP notifications| sink
  sink -->|AMQP call| central

RabbitMQ

Topology

oslo.messaging defaults apply: Designate never calls set_transport_defaults, so the control exchange is openstack unless [DEFAULT]/control_exchange is set (designate/rpc.py:81 is never called) [inferred from a code search]. The RPC servers listen on <topic> and <topic>.<host> (designate/service.py:107).

Serialisation: Designate objects travel as {"designate_object.name", "designate_object.version", "designate_object.data", "designate_object.changes", "designate_object.original_values"} primitives (designate/rpc.py:103), the context as DesignateContext.to_dict() (designate/rpc.py:153). Remote exceptions are rebuilt in the caller when their module is designate.exceptions or designate.backend.impl_dynect (designate/rpc.py:46). Timeout: rpc_response_timeout (60 s), after which the API answers 504 timeout (designate/api/middleware.py:289).

RPC methods

Topic central, version cap 6.12 (designate/central/rpcapi.py:92).

Topic worker, version cap 1.2 (designate/worker/rpcapi.py:50).

Notifications

Emitted by central with notifier.info(context, event_type, payload) after the outermost decorated call returns (designate/common/decorators/notification.py:85), publisher central.<host> (designate/rpc.py:225). The payload is the returned object (Default plugin, designate/notifications.py:71) or, with notification_plugin = audit, one change record per modified field (designate/notifications.py:80).

Sample frames

RPC call from the API (create_recordset), as sent on the central queue (shortened):

{"oslo.version": "2.0",
 "oslo.message": "{\"method\": \"create_recordset\", \"version\": \"6.12\", \"namespace\": null,
   \"args\": {\"zone_id\": \"a86dba58-0043-4cc6-a1bb-69d5e86f3ca3\",
              \"recordset\": {\"designate_object.name\": \"RecordSet\", \"designate_object.version\": \"1.0\",
                \"designate_object.data\": {\"name\": \"www.example.org.\", \"type\": \"A\", \"ttl\": 3600,
                  \"records\": {\"designate_object.name\": \"RecordList\", \"designate_object.data\":
                    {\"objects\": [{\"designate_object.name\": \"Record\", \"designate_object.data\": {\"data\": \"192.0.2.1\"}}]}}},
                \"designate_object.changes\": [\"name\", \"type\", \"ttl\", \"records\"]}},
   \"_msg_id\": \"<uuid>\", \"_reply_q\": \"reply_<uuid>\", \"_unique_id\": \"<uuid>\",
   \"_context_project_id\": \"<project>\", \"_context_roles\": [\"member\", \"reader\"],
   \"_context_all_tenants\": false, \"_context_edit_managed_records\": false,
   \"_context_hide_counts\": false, \"_context_request_id\": \"req-<uuid>\"}"}

Status report from the worker (cast, no _msg_id):

{"method": "update_status", "version": "6.12",
 "args": {"zone_id": "<uuid>", "status": "SUCCESS", "serial": 1793269000, "action": "UPDATE"}}

Database

SQLAlchemy Core tables (designate/storage/sqlalchemy/tables.py:49), Alembic migrations in designate/storage/sqlalchemy/alembic/versions (head f49c4409c8ba). Production schema and its differences with the tables: [_rewrite/schema-diff_stable-2026.2.md](_rewrite/schema-diff_stable-2026.2.md).

Tables

The migrations insert the default pool 794ccc2c-d751-44fe-b57f-8894c9f5c842 (designate/conf/central.py:41), without NS records nor targets: designate-manage pool update must run before the first zone (designate/central/service.py:914).

Notable transactions and queries

• Write sessions: @transaction wraps central methods in one write session; nested decorated calls join it (designate/storage/__init__.py:107). Retries on DBDeadlock re-run the whole method (designate/storage/__init__.py:39).
• Optimistic version: every UPDATE sets version = version + 1 (designate/storage/sqlalchemy/base.py:215), but no update filters on the version: last writer wins, the per-zone tooz lock is the only serialisation.
• Tenant filter: tenant_id = :project OR tenant_id IS NULL, plus shared_zones.target_project_id = :project where shares apply, unless all_tenants (designate/storage/sqlalchemy/base.py:165).
• Criterion mini-language: string values starting with !, <, <=, >, >=, BETWEEN a,b, or containing % (LIKE); lists become IN (designate/storage/sqlalchemy/base.py:129). The API maps * in filter values to % (designate/api/v2/controllers/rest.py:65).
• Paging: marker = id of the last item, ORDER BY <sort_key> <sort_dir>, id (designate/storage/sqlalchemy/utils.py:130).
• Recordset listing: one join recordsets ⟕ records with a total_count sub-query, optionally FORCE INDEX on MySQL for the cross-zone listing (designate/api/v2/controllers/common.py:31).

Coordination (tooz)

• [coordination]/backend_url (unset by default, designate/conf/coordination.py:26): Redis, etcd3, ZooKeeper, memcached… Central uses it for the per-zone locks zone-<id> and create-new-zone (designate/common/decorators/lock.py:85); the producer for the producer group and shard partitioning (designate/coordination.py:104). Without it, locks are local file locks and every producer owns every shard.

DNS protocol

Sample NOTIFY sent by the worker for example.org. (header fields as built by dnspython make_query then set_opcode(NOTIFY), designate/dnsutils.py:222):

ID=<random>  QR=0  OPCODE=NOTIFY (4)  RD=1 (make_query default)  QDCOUNT=1
QUESTION: example.org. IN SOA
ADDITIONAL: TSIG <key name> hmac-sha256 … (only when the target has a tsigkey_id)

The DNS server answers with QR=1 OPCODE=NOTIFY; the worker does not check the answer's rcode, only that one came back before the timeout (designate/worker/tasks/zone.py:188). The SOA served by mdns for a primary zone is <lowest-priority NS hostname> <email with '@' → '.'>. <serial> <refresh> <retry> <expire> <minimum> (designate/central/service.py:414), the serial being a Unix timestamp set by central (designate/storage/sqlalchemy/__init__.py:628).

Backend drivers (pool targets)

The worker calls the driver named by each target's type (stevedore designate.backend, designate/backend/__init__.py:27). All the drivers below configure the DNS server as a secondary of mdns: Designate never writes records to the DNS server, the server pulls the whole zone by AXFR from mdns.

Outbound REST calls

Other

• Binaries: rndc through designate-rootwrap (designate/backend/impl_bind9.py:208, etc/designate/rootwrap.d/bind9.filters).
• Files: none besides configuration, the pools YAML file (read by designate-manage) and the Jinja2 export template designate/resources/templates/export-zone.jinja2.

Source: reverse-spec-designate/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.