Restrict zone names to DNS label characters

config/crd/bases/bind.unkin.net_bindcatalogzones.yaml

@@ -73,7 +73,12 @@ spec:
                   transfers to secondaries.
                 type: string
               zoneName:
-                description: ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+                description: |-
+                  ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+                  interpolated into shell commands run in the BIND pod, so it is restricted
+                  to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef

config/crd/bases/bind.unkin.net_bindclusters.yaml

@@ -995,8 +995,9 @@ spec:
                 type: array
               image:
                 default: internetsystemsconsortium/bind9:9.20
-                description: Image is the BIND9 container image. Must ship named,
-                  rndc and nsupdate.
+                description: |-
+                  Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+                  the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
                 type: string
               imagePullPolicy:
                 description: ImagePullPolicy for the BIND container.

config/crd/bases/bind.unkin.net_bindpolicies.yaml

@@ -118,7 +118,12 @@ spec:
                 description: ViewRef optionally scopes the policy to a single view.
                 type: string
               zoneName:
-                description: ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+                description: |-
+                  ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+                  into shell commands run in the BIND pod, so it is restricted to DNS label
+                  characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef

config/crd/bases/bind.unkin.net_bindzones.yaml

@@ -159,7 +159,12 @@ spec:
                 description: ViewRef optionally binds this zone to a BindView.
                 type: string
               zoneName:
-                description: ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                description: |-
+                  ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                  It is interpolated into shell commands run in the BIND pod, so it is
+                  restricted to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef

config/crd/install.yaml

@@ -219,7 +219,12 @@ spec:
                   transfers to secondaries.
                 type: string
               zoneName:
-                description: ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+                description: |-
+                  ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+                  interpolated into shell commands run in the BIND pod, so it is restricted
+                  to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
@@ -1300,8 +1305,9 @@ spec:
                 type: array
               image:
                 default: internetsystemsconsortium/bind9:9.20
-                description: Image is the BIND9 container image. Must ship named,
-                  rndc and nsupdate.
+                description: |-
+                  Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+                  the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
                 type: string
               imagePullPolicy:
                 description: ImagePullPolicy for the BIND container.
@@ -1937,7 +1943,12 @@ spec:
                 description: ViewRef optionally scopes the policy to a single view.
                 type: string
               zoneName:
-                description: ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+                description: |-
+                  ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+                  into shell commands run in the BIND pod, so it is restricted to DNS label
+                  characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
@@ -2813,7 +2824,12 @@ spec:
                 description: ViewRef optionally binds this zone to a BindView.
                 type: string
               zoneName:
-                description: ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                description: |-
+                  ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                  It is interpolated into shell commands run in the BIND pod, so it is
+                  restricted to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef