Configure resolvers like puppet (openforwarder view + forward zones)
Fixes recursion being refused for external clients: the resolver had no allow-recursion, so BIND defaulted to localnets. Mirrors the puppet resolver config exactly. - add openforwarder BindView: match-clients = internal ACLs, recursion yes, allow-recursion/allow-query any (match-clients gates access) - add 4 BindACLs (acl-main.unkin.net / acl-dmz / acl-common / acl-nomad-jobs) from puppet acls.conf - add 26 conditional forward zones (unkin/consul/k8s/dmz upstreams), bound to the openforwarder view; needs operator v0.1.4 to render them on every pod - global forwarders 8.8.8.8/1.1.1.1 (puppet default) - bump operator image to v0.1.4
This commit is contained in:
@@ -0,0 +1,374 @@
|
||||
# Conditional forward zones, mirrored from puppet openforwarder view.
|
||||
# Upstreams are the puppet anycast servers (unkin 198.18.19.15, consul .14,
|
||||
# k8s .20); flip to the in-cluster authoritative/externaldns LBs once zone
|
||||
# data is migrated.
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-main-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: main.unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-dmz-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: dmz.unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-network-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: network.unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-prod-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: prod.unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-consul
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: consul
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.14
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-k8s-syd1-au-unkin-net
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: k8s.syd1.au.unkin.net
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.20
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-13-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 13.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-14-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 14.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-15-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 15.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-16-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 16.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-17-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 17.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-19-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 19.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-20-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 20.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-21-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 21.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-22-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 22.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-23-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 23.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-24-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 24.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-25-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 25.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-26-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 26.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-27-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 27.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-28-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 28.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-29-18-198-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 29.18.198.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 198.18.19.15
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-8-10-10-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 8.10.10.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-16-10-10-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 16.10.10.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
---
|
||||
apiVersion: bind.unkin.net/v1alpha1
|
||||
kind: BindZone
|
||||
metadata:
|
||||
name: fwd-20-10-10-in-addr-arpa
|
||||
namespace: bind-internal
|
||||
spec:
|
||||
clusterRef: bind-resolvers
|
||||
viewRef: openforwarder
|
||||
zoneName: 20.10.10.in-addr.arpa
|
||||
type: forward
|
||||
catalog: false
|
||||
forwarders:
|
||||
- 10.10.16.32
|
||||
- 10.10.16.33
|
||||
Reference in New Issue
Block a user