unkinben
d11c2900de
Adds the bind-operator and the three BindClusters that replace the Puppet-managed BIND estate (authoritative / resolver / external-dns). - add apps/base/bind-system: 9 CRDs, operator Deployment, RBAC (ns bind-system) - add apps/base/binddns-auth: authoritative BindCluster + catalog zone + TSIG key - add apps/base/binddns-resolver: recursive-resolver BindCluster with forwarders - add apps/base/binddns-externaldns: dynamic (RFC2136) BindCluster + TSIG key - add au-syd1 overlays for all four apps - register the four apps in the platform ApplicationSet - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the new CRs DNS Services are LoadBalancer via PureLB. TSIG key material is generated by the operator into Secrets at runtime (no plain Secrets in git).
26 lines
642 B
YAML
26 lines
642 B
YAML
---
|
|
# external-dns tier (replaces the 3x Puppet external-dns servers). The primary
|
|
# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: externaldns
|
|
namespace: binddns-externaldns
|
|
spec:
|
|
mode: dynamic
|
|
replicas: 3
|
|
storageClassName: cephrbd-fast-delete
|
|
storageSize: 1Gi
|
|
service:
|
|
type: LoadBalancer
|
|
annotations:
|
|
purelb.io/service-group: dmz
|
|
external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|