Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers
declaratively, using controller-runtime (matching forgebot conventions).

- add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries),
  headless + client Services, rendered named.conf ConfigMap, TSIG keys
  Secret and rndc control Secret; watches dependent CRs to re-render
- add BindTSIGKey reconciler that generates key material into a Secret
- add BindZone/DNSRecord reconcilers using fully-dynamic delivery
  (rndc addzone + TSIG nsupdate against the primary pod)
- add BindCatalogZone reconciler so secondaries auto-provision zones
- add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers
- render primary/secondary named.conf variants selected by pod ordinal
- generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet
  roles (authoritative/resolver/external-dns) to three BindClusters
- add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests

config/samples/01-authoritative.yaml

@@ -0,0 +1,102 @@
+---
+# Authoritative masters role (replaces 3x Puppet authoritative servers).
+# Ordinal-0 is the primary holding zone data; the other two replicate via the
+# catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: bind-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: internal-nets
+  namespace: bind-auth
+spec:
+  clusterRef: auth
+  entries:
+    - 10.0.0.0/8
+    - 192.168.0.0/16
+---
+# Catalog zone: new BindZones are auto-provisioned onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: bind-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindDNSSECPolicy
+metadata:
+  name: standard
+  namespace: bind-auth
+spec:
+  clusterRef: auth
+  algorithm: ecdsap256sha256
+  nsec3: true
+  csk:
+    lifetime: unlimited
+---
+# Forward zone (signed) with a couple of seeded records.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: example-internal
+  namespace: bind-auth
+spec:
+  clusterRef: auth
+  zoneName: internal.example.com
+  type: primary
+  defaultTTL: 3600
+  dnssecPolicyRef: standard
+  allowTransfer:
+    - key transfer-key
+  updateKeyRef: transfer-key
+  dynamicUpdate: true
+  records:
+    - name: "@"
+      type: NS
+      values: ["ns1.internal.example.com."]
+    - name: ns1
+      type: A
+      values: ["10.0.0.53"]
+    - name: www
+      type: A
+      values: ["10.0.1.10", "10.0.1.11"]
+---
+# Reverse zone for 10.0.0.0/16.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: reverse-10-0
+  namespace: bind-auth
+spec:
+  clusterRef: auth
+  zoneName: 0.10.in-addr.arpa
+  type: primary
+  updateKeyRef: transfer-key
+  dynamicUpdate: true
+  allowTransfer:
+    - key transfer-key
+  records:
+    - name: "53.0"
+      type: PTR
+      values: ["ns1.internal.example.com."]