Target upstream ISC bind9 image

Uses internetsystemsconsortium/bind9 as the default base image instead of
a self-hosted one, verified against internetsystemsconsortium/bind9:9.20
(runs as root; named/rndc/nsupdate at /usr/sbin,/usr/sbin,/usr/bin).

- project operator config at /etc/bind-operator instead of overmounting
  the image's /etc/bind (keeps bind.keys / base config intact)
- reference named/rndc/nsupdate by absolute path (exec PATH may exclude
  /usr/sbin)
- centralise filesystem + binary paths in internal/bind/consts.go
- default spec.image to internetsystemsconsortium/bind9:9.20

internal/bind/consts.go

@@ -0,0 +1,37 @@
+package bind
+
+// Filesystem layout and binary locations inside a BIND pod. The operator mounts
+// its rendered config at ConfigDir (a path distinct from the image's own
+// /etc/bind, so the base image's bind.keys trust anchors remain available for
+// dnssec-validation).
+const (
+	// ContainerName is the BIND container name within each pod.
+	ContainerName = "bind"
+
+	// ConfigDir is where the operator projects named.conf, keys and the
+	// entrypoint. Kept separate from the image's /etc/bind.
+	ConfigDir = "/etc/bind-operator"
+
+	// DataDir is BIND's writable working directory (backed by the PVC): zone
+	// databases and journals.
+	DataDir = "/var/lib/named"
+
+	// RunDir holds the ordinal-selected named.conf (writable emptyDir).
+	RunDir = "/run/named"
+
+	// Binary locations in the ISC BIND9 image (Debian/Ubuntu layout).
+	NamedBin    = "/usr/sbin/named"
+	RndcBin     = "/usr/sbin/rndc"
+	NsupdateBin = "/usr/bin/nsupdate"
+)
+
+// Config file paths derived from ConfigDir.
+const (
+	NamedConfRun       = RunDir + "/named.conf"
+	NamedConfPrimary   = ConfigDir + "/named.conf.primary"
+	NamedConfSecondary = ConfigDir + "/named.conf.secondary"
+	EntrypointPath     = ConfigDir + "/entrypoint.sh"
+	KeysConfPath       = ConfigDir + "/keys.conf"
+	RndcKeyPath        = ConfigDir + "/rndc.key"
+	RndcConfPath       = ConfigDir + "/rndc.conf"
+)

internal/bind/exec.go

@@ -14,9 +14,6 @@ import (
 	"k8s.io/client-go/tools/remotecommand"
 )
 
-// ContainerName is the BIND container name within each pod.
-const ContainerName = "bind"
-
 // Executor runs commands inside BIND pods via the exec subresource.
 type Executor struct {
 	config    *rest.Config

internal/bind/nsupdate.go

@@ -41,7 +41,7 @@ func (e *Executor) NSUpdate(ctx context.Context, namespace, pod, zone string, cr
 	}
 	b.WriteString("send\n")
 
-	cmd := []string{"nsupdate", "-y", fmt.Sprintf("%s:%s:%s", creds.Algorithm, creds.Name, creds.Secret)}
+	cmd := []string{NsupdateBin, "-y", fmt.Sprintf("%s:%s:%s", creds.Algorithm, creds.Name, creds.Secret)}
 	if out, err := e.Exec(ctx, namespace, pod, cmd, b.String()); err != nil {
 		return fmt.Errorf("nsupdate zone %s: %w (out: %s)", zone, err, out)
 	}

internal/bind/render.go

@@ -20,9 +20,6 @@ type RenderInput struct {
 	PrimaryAddress string
 }
 
-// DataDir is where BIND keeps zone databases and journals (backed by the PVC).
-const DataDir = "/var/lib/named"
-
 // RenderNamedConf returns the primary and secondary named.conf contents for a
 // cluster. Both variants are shipped in the ConfigMap; the entrypoint selects
 // one based on the pod ordinal.
@@ -35,7 +32,8 @@ func render(in RenderInput, isPrimary bool) string {
 	var b strings.Builder
 
 	b.WriteString("// Managed by bind-operator. Do not edit.\n")
-	b.WriteString(`include "/etc/bind/keys/keys.conf";` + "\n\n")
+	b.WriteString(fmt.Sprintf("include \"%s\";\n", RndcKeyPath))
+	b.WriteString(fmt.Sprintf("include \"%s\";\n\n", KeysConfPath))
 
 	// Named ACLs (global scope).
 	acls := append([]bindv1alpha1.BindACL(nil), in.ACLs...)

internal/bind/rndc.go

@@ -6,12 +6,9 @@ import (
 	"strings"
 )
 
-// RndcConfPath is the operator-managed rndc client config mounted in each pod.
-const RndcConfPath = "/etc/bind/rndc.conf"
-
 // Rndc runs `rndc <args...>` on a pod and returns its output.
 func (e *Executor) Rndc(ctx context.Context, namespace, pod string, args ...string) (string, error) {
-	base := []string{"rndc", "-c", RndcConfPath}
+	base := []string{RndcBin, "-c", RndcConfPath}
 	return e.Exec(ctx, namespace, pod, append(base, args...), "")
 }