unkinben
c8d61205ce
## Why `dig google.com @198.18.200.7` was refused: the resolver never set allow-recursion, so BIND defaulted to localnets/localhost. This mirrors the puppet resolver (/etc/named/views.conf + acls.conf) exactly. ## Changes - `openforwarder` BindView: `match-clients` = the 4 internal ACLs, recursion yes, allow-recursion/allow-query `any` (match-clients gates) - 4 BindACLs from puppet acls.conf (acl-main.unkin.net/acl-dmz/acl-common/acl-nomad-jobs) - 26 conditional forward zones in the view (unkin→198.18.19.15, consul→.14, k8s→.20, dmz/network/prod + 10.10.x reverse → 10.10.16.32/33) - global forwarders 8.8.8.8/1.1.1.1 - operator image → v0.1.4 ## Note Forward-zone upstreams point at the **puppet anycast** servers (still authoritative during migration); flip to the in-cluster authoritative/externaldns LBs once zone data is migrated. ## Validated kustomize build (59 docs), kubeconform clean. Reviewed-on: #226 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
285 lines
5.8 KiB
YAML
285 lines
5.8 KiB
YAML
# Conditional forward zones, from the puppet openforwarder view.
|
|
# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14, k8s 198.18.200.8.
|
|
# k8s -> in-cluster bind-externaldns 198.18.200.8.
|
|
# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: unkin.net
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-main-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: main.unkin.net
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-consul
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: consul
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.19.14
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-k8s-syd1-au-unkin-net
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: k8s.syd1.au.unkin.net
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.8
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-13-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 13.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-14-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 14.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-15-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 15.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-16-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 16.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-17-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 17.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-19-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 19.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-20-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 20.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-21-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 21.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-22-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 22.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-23-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 23.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-24-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 24.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-25-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 25.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-26-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 26.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-27-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 27.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-28-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 28.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: fwd-29-18-198-in-addr-arpa
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
viewRef: openforwarder
|
|
zoneName: 29.18.198.in-addr.arpa
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 198.18.200.6
|