unkin-agent
2493e729f4
Recursing public names in-cluster SERVFAILs a few percent of cold lookups and loses the cache on every restart, which breaks CI. DNSBLs refuse or poison queries relayed via public resolvers, so rspamd's RBL lookups must keep resolving directly. - add global forwarders 1.1.1.1 and 8.8.8.8 (forward first) to bind-resolvers - add empty-forwarder zones to the openforwarder view for the RBL domains rspamd queries, so they resolve iteratively Reviewed-on: #555 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
---
|
|
# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
|
|
# Three identical recursive servers; no zone replication.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: bind-resolvers
|
|
namespace: bind-internal
|
|
spec:
|
|
mode: resolver
|
|
replicas: 3
|
|
storageClassName: cephrbd-fast-delete
|
|
storageSize: 1Gi
|
|
service:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
annotations:
|
|
purelb.io/service-group: common
|
|
purelb.io/addresses: 198.18.200.7
|
|
external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
|
|
# Public names go via global forwarders; RBL zones bypass them (view.yaml).
|
|
forwarders:
|
|
- 1.1.1.1
|
|
- 8.8.8.8
|
|
# The internal split-horizon zones are served UNSIGNED by the in-cluster
|
|
# authoritative, but their public parents publish DS records (e.g. unkin.net
|
|
# is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
|
|
# sees "parent indicates secure" but gets an insecure answer and returns
|
|
# SERVFAIL (broken trust chain). Treat the forwarded internal domains as
|
|
# insecure so they are not validated. unkin.net covers all *.unkin.net
|
|
# (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
|
|
extraOptions:
|
|
- "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
|
|
# Enable query logging so the Tier-2 vector bind_query pipeline can parse
|
|
# client/qname/qtype. Routes to the `queries` category which, with no explicit
|
|
# logging{} clause, follows the default category to the named foreground
|
|
# stderr channel -> pod stdout -> vector (subject logs.k8s.bind-internal.*).
|
|
- "querylog yes"
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|