Restrict authoritative queries to internal networks (#227)

Mirrors the puppet authoritative `master-zones` view (match-clients `acl-main.unkin.net`, recursion no) — restricting who can query bind-authoritative.

## Changes
- add `auth-acl-main` BindACL with the puppet authoritative acl-main.unkin.net networks (13-17,19,20,24-29)
- `allow-query { auth-acl-main; 10.42.0.0/16; }` on bind-authoritative via extraOptions

## Notes
- Implemented as a global `allow-query` rather than a BindView: dynamic *primary* zones inside a view would need per-view `allow-new-zones` (an operator gap). Functionally equivalent for the single master-zones view.
- `10.42.0.0/16` (pod network) is included so secondaries can SOA-refresh from the primary during catalog replication — without it, replication breaks.
- Works on the current operator (no HOLD).

## Caveat
The DNS Services use externalTrafficPolicy: Cluster, which SNATs external clients to node IPs (198.18.19.x, already in acl-main), so this ACL doesn't truly restrict *external* clients yet. True source-IP restriction needs externalTrafficPolicy: Local — happy to switch if wanted.

Reviewed-on: #227
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #227.

This commit is contained in:

Ben Vincent

2026-07-04 22:15:43 +10:00

committed by

BenVincent

parent c8d61205ce

commit 3ab8bcc34b

3 changed files with 32 additions and 0 deletions

									
										apps/base/bind-internal/authoritative/kustomization.yaml
									
		+1
		
												View File
												
				@@ -6,3 +6,4 @@ resources:

				  - cluster.yaml

				  - tsigkey.yaml

				  - zones.yaml

				  - acls.yaml