unkin-agent
9188ef9ac3
The in-cluster BIND resolvers have no IPv6 route but still try every AAAA nameserver. Each attempt fails with "network unreachable" yet counts toward the per-query recursion budget, so cold lookups of names with many dual-stack NS (registry.opentofu.org, cloudfront, crates.io, gcr.io) hit `quota reached` and SERVFAIL, surfacing as transient DNS errors in CI. - mark all IPv6 servers bogus in the openforwarder view so recursion is IPv4-only Reviewed-on: #553 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
26 lines
709 B
YAML
26 lines
709 B
YAML
---
|
|
# openforwarder view, mirrored from puppet /etc/named/views.conf.
|
|
# match-clients gates access to internal networks; recursion/query are 'any'
|
|
# within the view since match-clients already restricts who reaches it.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindView
|
|
metadata:
|
|
name: openforwarder
|
|
namespace: bind-internal
|
|
spec:
|
|
clusterRef: bind-resolvers
|
|
order: 100
|
|
matchClients:
|
|
- acl-main.unkin.net
|
|
- acl-nomad-jobs
|
|
- acl-common
|
|
- acl-dmz
|
|
recursion: true
|
|
allowQuery:
|
|
- any
|
|
extraOptions:
|
|
- "allow-recursion { any; }"
|
|
- "allow-query-cache { any; }"
|
|
# pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
|
|
- "server ::/0 { bogus yes; }"
|