Neutron DNS Integration: External Provider Record Cleanup and TLS Verification Behavior

Direct answer

Confirmed: the dnsmasq DNS integration does not purge records on port deletion and relies on TTL expiry. For external DNS provider plugins, guaranteed delete-on-port-delete is not documented as universal Neutron core behavior. The actual cleanup depends on the specific provider driver and its Neutron release configuration.

Likely explanation, not confirmed core fact: many external provider drivers implement an opt-in delete path that is sent when a port is removed, and TLS verification settings affect connection success but do not change the plugin to plain HTTP.

1. Delete operation on port removal

Confirmed fact: dnsmasq integration leaves stale entries until TTL expires.

Likely explanation for external providers: delete is not automatic by default. Drivers commonly expose a flag to enable record removal on port delete, e.g., a delete-records-on-port-delete option. If the flag is disabled or absent, the driver relies on provider TTL for cleanup.

2. TLS verification disabled

Disabling TLS verification does not cause a silent fallback to insecure HTTP. The plugin continues to use HTTPS with certificate validation skipped. The delete request is still attempted, but connection failures due to provider-side rejection of unverified TLS will cause the delete to fail and be logged. Delivery is therefore affected by reachability, not by a protocol downgrade.

3. Synchronous cleanup knobs

There is no single Neutron-wide knob guaranteed across releases. Some driver implementations provide a force or synchronous delete option that blocks port deletion until the provider acknowledges or times out. Where present, it enforces an attempt at immediate removal regardless of TTL. Where absent, cleanup is best-effort and may fall back to TTL.

What to verify for this case

• Identify the exact Neutron release and the external DNS provider driver name in use. Behavior differs between releases and drivers.
• Check the driver configuration for any delete-on-port-delete and force/synchronous delete options, and whether they are enabled.
• Enable debug logging for the DNS provider driver and create then delete a test port. Confirm a DELETE-type API call is emitted to the provider and check provider audit logs for receipt.
• Repeat with TLS verification disabled and observe connection errors in Neutron logs to confirm the plugin remains on HTTPS with unverified certs.

Missing diagnostic detail that changes recommendation: the Neutron release version and the exact external DNS provider driver name. Without those, configuration key names and supported options cannot be confirmed.