Restrict zone names to DNS label characters

api/v1alpha1/bindcatalogzone_types.go

@@ -11,7 +11,11 @@ type BindCatalogZoneSpec struct {
 	// ClusterRef names the owning BindCluster.
 	ClusterRef string `json:"clusterRef"`
 
-	// ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+	// ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+	// interpolated into shell commands run in the BIND pod, so it is restricted
+	// to DNS label characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// DefaultPrimaries are the addresses member zones point at on secondaries.

api/v1alpha1/bindcluster_types.go

@@ -58,7 +58,8 @@ type BindClusterSpec struct {
 	// +optional
 	Replicas int32 `json:"replicas,omitempty"`
 
-	// Image is the BIND9 container image. Must ship named, rndc and nsupdate.
+	// Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+	// the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
 	// +kubebuilder:default="internetsystemsconsortium/bind9:9.20"
 	// +optional
 	Image string `json:"image,omitempty"`

api/v1alpha1/bindpolicy_types.go

@@ -42,7 +42,11 @@ type BindPolicySpec struct {
 	// +optional
 	ViewRef string `json:"viewRef,omitempty"`
 
-	// ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+	// ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+	// into shell commands run in the BIND pod, so it is restricted to DNS label
+	// characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// Order controls this policy's position in the response-policy clause.

api/v1alpha1/bindzone_types.go

@@ -48,6 +48,10 @@ type BindZoneSpec struct {
 	ViewRef string `json:"viewRef,omitempty"`
 
 	// ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+	// It is interpolated into shell commands run in the BIND pod, so it is
+	// restricted to DNS label characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// Type is the zone type. Defaults to primary.