Add a prerequisite check for the nsupdate var

roles/openshift_openstack/tasks/check-prerequisites.yml

@@ -117,3 +117,13 @@
       by your cloud.
   when: (openshift_openstack_use_lbaas_load_balancer and openshift_openstack_lbaasv2_provider == 'Neutron::LBaaS' and 'lbaasv2' not in openstack_network_extensions) or
         (openshift_openstack_use_lbaas_load_balancer and openshift_openstack_lbaasv2_provider == 'Octavia' and 'load-balancer' not in openstack_service_catalog)
+
+- name: Verify the nsupdate zone is a subset of the full cluster domain
+  fail:
+    msg: >
+      The `openshift_openstack_nsupdate_zone` ({{ openshift_openstack_nsupdate_zone }})
+      must be a substring of `openshift_openstack_full_dns_domain ({{ openshift_openstack_full_dns_domain }})`
+  when:
+  - openshift_openstack_nsupdate_zone is defined
+  - openshift_openstack_full_dns_domain is defined
+  - openshift_openstack_full_dns_domain is not match(".*" + openshift_openstack_nsupdate_zone + "$")