fix: reject network_state dns-resolver when NM global-dns is configured

[pfeifferj]

Enhancement:

The network_state module checks NetworkManager's configuration files (NetworkManager.conf and the conf.d directories) for a [global-dns] or [global-dns-domain-*] section before applying a state that contains dns-resolver, and fails with an error naming the file and the workarounds.

Reason:

nmstate stores and purges dns-resolver through NetworkManager's D-Bus global DNS API. NetworkManager refuses that call while global DNS comes from a configuration file, and nmstate surfaces the refusal as an "Global DNS configuration already set via configuration file" error, which the role forwarded as a module traceback. Neither NetworkManager nor nmstate plan to change this, so the role reports the configuration as unsupported, as agreed on in RHEL-4450.

Result:

Users with a [global-dns] section get an actionable error telling them to remove the section and reload NetworkManager, or to configure DNS on the connection profiles instead of dns-resolver. Global DNS set over D-Bus (what nmstate itself writes) lives in [.intern.*] groups and does not trigger the check.

Issue Tracker Tickets (Jira or BZ if any):

RHEL-4450, RHEL-3257, NMT-1833

Signed-off-by: Josephine Pfeiffer josie@redhat.com

Summary by CodeRabbit

• Bug Fixes

  • dns-resolver configurations now fail with a clear explanation when NetworkManager global DNS settings are present, instead of producing an internal error.
  • DNS resolver configuration continues to apply when no conflicting global DNS settings are detected.

• Documentation

  • Added guidance on the limitation, failure behavior, and available workarounds.

• Tests

  • Added coverage for global DNS detection, configuration precedence, unsupported scenarios, and successful DNS resolver configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 165ba48c-c604-4642-bb6f-b4e7c95bf5c5

📥 Commits

Reviewing files that changed from the base of the PR and between cb972f1 and cdb24d7.

📒 Files selected for processing (1)

• tests/unit/test_network_state.py

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change detects NetworkManager global DNS configuration before applying dns-resolver, reports unsupported configurations, documents workarounds, and adds unit and NetworkManager integration tests.

Changes

Global DNS validation

Layer / File(s)	Summary
Global DNS detection and request guard library/network_state.py, tests/unit/test_network_state.py, README.md	network_state scans the main NetworkManager configuration and active snippets for global DNS sections. It rejects incompatible dns-resolver requests, adds unit coverage, and documents the limitation and workarounds.
NetworkManager integration test tests/playbooks/tests_network_state_global_dns.yml, tests/tests_network_state_global_dns_nm.yml, tests/ensure_provider_tests.py	The integration test creates global DNS configuration, verifies the expected role failure, restores NetworkManager state, and runs only on supported NetworkManager distributions.

Merge Risk: ⚪ Minimal · up to cdb24

dns-resolver requests now fail early with actionable guidance when file-based NetworkManager global DNS configuration makes the requested operation unsupported. The behavior is documented and covered for the relevant configuration paths, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format with the valid fix type and clearly describes the change.
Description check	✅ Passed	The description includes all required sections and provides clear details about the enhancement, reason, result, and related issue tracker tickets.
Docstring Coverage	✅ Passed	Docstring coverage is 94.74% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 19 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Format	✅ Passed	The PR description contains the required Enhancement, Reason, and Result sections. It also includes the optional Issue Tracker Tickets section and a valid Signed-off-by line with a name and email addr…

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[spetrosi]

[citest_all]

[spetrosi]

[citest_all]