Configure resolvers like puppet (openforwarder view + forward zones) (#226)

## Why
`dig google.com @198.18.200.7` was refused: the resolver never set allow-recursion, so BIND defaulted to localnets/localhost. This mirrors the puppet resolver (/etc/named/views.conf + acls.conf) exactly.

## Changes
- `openforwarder` BindView: `match-clients` = the 4 internal ACLs, recursion yes, allow-recursion/allow-query `any` (match-clients gates)
- 4 BindACLs from puppet acls.conf (acl-main.unkin.net/acl-dmz/acl-common/acl-nomad-jobs)
- 26 conditional forward zones in the view (unkin→198.18.19.15, consul→.14, k8s→.20, dmz/network/prod + 10.10.x reverse → 10.10.16.32/33)
- global forwarders 8.8.8.8/1.1.1.1
- operator image → v0.1.4

## Note
Forward-zone upstreams point at the **puppet anycast** servers (still authoritative during migration); flip to the in-cluster authoritative/externaldns LBs once zone data is migrated.

## Validated
kustomize build (59 docs), kubeconform clean.

Reviewed-on: #226
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #226.

This commit is contained in:

Ben Vincent

2026-07-04 21:55:33 +10:00

committed by

BenVincent

parent ce8ebc71ce

commit c8d61205ce

6 changed files with 377 additions and 2 deletions

									
										apps/base/bind-internal/resolvers/cluster.yaml
									
		+1
		-1
	
												View File
												
				@@ -18,8 +18,8 @@ spec:

				      purelb.io/addresses: 198.18.200.7

				      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net

				  forwarders:

				    - 8.8.8.8

				    - 1.1.1.1

				    - 9.9.9.9

				  resources:

				    requests:

				      cpu: 100m