Bootstrap DNS Inventory for Domains That Predate Automation: Capture Before Convergence

说明与用途

在自动化之前捕获只读 DNS 快照可防止意外删除关键记录，并提供清晰的回滚路径。

问题

When domains predate automation, starting DNS automation can inadvertently delete critical records if the current state is not captured and reviewed.

结果

Capturing a read‑only DNS snapshot before enabling automation prevents accidental record deletion and provides a clear rollback path.

工作流

• 1. List all DNS zones via provider API.
• 2. For each zone, retrieve all records.
• 3. Store raw JSON responses exactly as received.
• 4. Normalize records into a table with fields: owner name, type, value, TTL, routing/priority attributes.
• 5. Keep both raw and normalized representations; never overwrite raw copy.
• 6. Compute a deterministic SHA‑256 hash of the snapshot for integrity verification.
• 7. Package raw snapshot, normalized diff, and hash into a review bundle.
• 8. Mark bundle as REVIEW_REQUIRED and prevent write credentials for the bootstrap job.
• 9. Have a human reviewer approve the diff before enabling DNS writes.
• 10. Once approved, proceed with automated provisioning.

证据

list every zone, read its records, preserve that read-only snapshot as the initial intended state, and ask a person to review the diff before provisioning starts to converge on it.

来源

Treat silence as “needs review,” not as permission to delete.

来源