List DNS Zone different domains

[fini03]

Hello,

i created a DNS Zone with cloudstack admin user with domain ROOT. In my rules setting of the role User I enabled listDNSZone but the Zones are not listed. The user has the domain ROOT/USER so it should show everything that is under ROOT as with Templates or?

[boring-cyborg[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template!

[kiranchavala]

cc @sudo87

[sudo87]

@fini03 listDNSZone returns dns zone which are created/owned by the user.
In your scenario, dns zone is created by admin so no other user can see it. There is no public dns zone (unlike templates). Hope this clarifies.

[fini03]

Thank you so much for the clarification! Would it be possible for the user to create a subdomain?

[nickaccuweb]

Yes, but not directly inside the admin-owned DNS zone.

If the admin configures the DNS Server as Public and sets a publicdomainsuffix such as demovpstest.com, a normal user can create their own DNS zone and CloudStack will create it as a subdomain, for example:

customer1.demovpstest.com

The user will own and manage that DNS zone. They still won't get access to the admin-owned example.com zone itself.

https://docs.cloudstack.apache.org/en/latest/adminguide/networking/dns_framework.html

[sudo87]

Yes its possible to setup subdomain or even domains under dns server setup by admin. Only thing admin has to mark the DNS server public while configuring it.

Refer to this doc https://docs.cloudstack.apache.org/en/4.23.0.0/adminguide/networking/dns_framework.html#adding-a-dns-server

[nickaccuweb]

Hello,

This is expected behavior.

Enabling listDnsZones only allows the user to call the API. It does not make DNS zones from the ROOT/admin account visible to users under that domain.

DNS zones are account-owned resources, so a user will normally see only the zones owned by their own account.

This is different from templates, where visibility can be shared or public.

Regards,