Initial bind-operator: 9 CRDs + controllers

Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
2026-07-03 15:48:13 +10:00
parent b3a5b4d0b7
commit fe5fbdaf6d
63 changed files with 8240 additions and 1 deletions
@@ -0,0 +1,223 @@
+package controller
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
+	"git.unkin.net/unkin/bind-operator/internal/bind"
+)
+
+// BindZoneReconciler provisions zones on a cluster primary via rndc addzone and
+// seeds records via dynamic update.
+type BindZoneReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+	Exec   *bind.Executor
+}
+
+// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindzones,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindzones/status,verbs=get;update;patch
+// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindcatalogzones;bindtsigkeys,verbs=get;list;watch
+
+func (r *BindZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	var zone bindv1alpha1.BindZone
+	if err := r.Get(ctx, req.NamespacedName, &zone); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	cluster, err := getCluster(ctx, r.Client, zone.Namespace, zone.Spec.ClusterRef)
+	if err != nil {
+		return r.setPhase(ctx, &zone, "Error", "ClusterMissing", err.Error())
+	}
+	primaryPod := primaryPodName(cluster.Name)
+
+	// Handle deletion via finalizer: remove the zone from the primary and catalog.
+	if !zone.DeletionTimestamp.IsZero() {
+		if controllerutil.ContainsFinalizer(&zone, finalizer) {
+			if primaryReady(ctx, r.Client, cluster) && r.Exec != nil {
+				_ = r.Exec.DelZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
+				r.deregisterCatalog(ctx, &zone, cluster, primaryPod)
+			}
+			controllerutil.RemoveFinalizer(&zone, finalizer)
+			if err := r.Update(ctx, &zone); err != nil {
+				return ctrl.Result{}, err
+			}
+		}
+		return ctrl.Result{}, nil
+	}
+
+	if !controllerutil.ContainsFinalizer(&zone, finalizer) {
+		controllerutil.AddFinalizer(&zone, finalizer)
+		if err := r.Update(ctx, &zone); err != nil {
+			return ctrl.Result{}, err
+		}
+	}
+
+	if !primaryReady(ctx, r.Client, cluster) || r.Exec == nil {
+		return r.setPhase(ctx, &zone, "Pending", "PrimaryNotReady", "waiting for cluster primary to be ready")
+	}
+
+	zoneConfig, err := r.buildZoneConfig(ctx, &zone)
+	if err != nil {
+		return r.setPhase(ctx, &zone, "Error", "ConfigError", err.Error())
+	}
+
+	created := !r.Exec.ZoneExists(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
+	if created && zone.Spec.Type == bindv1alpha1.ZonePrimary || (created && zone.Spec.Type == "") {
+		if err := r.Exec.WriteSeedZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, bind.ZoneFilePath(zone.Spec.ZoneName), "", 1); err != nil {
+			return r.setPhase(ctx, &zone, "Error", "SeedFailed", err.Error())
+		}
+	}
+	if err := r.Exec.AddZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef, zoneConfig); err != nil {
+		return r.setPhase(ctx, &zone, "Error", "AddZoneFailed", err.Error())
+	}
+
+	// Seed static records (primary zones only).
+	recordCount := 0
+	if isPrimaryType(zone.Spec.Type) && len(zone.Spec.Records) > 0 {
+		creds, err := r.zoneUpdateCreds(ctx, &zone)
+		if err != nil {
+			return r.setPhase(ctx, &zone, "Error", "NoUpdateKey", err.Error())
+		}
+		updates := recordsToUpdates(zone.Spec.ZoneName, zone.Spec.Records, zone.Spec.DefaultTTL)
+		if err := r.Exec.NSUpdate(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, creds, updates); err != nil {
+			return r.setPhase(ctx, &zone, "Error", "RecordUpdateFailed", err.Error())
+		}
+		recordCount = len(updates)
+	}
+
+	// Register in the catalog so secondaries auto-provision.
+	if catalogEnabled(&zone) {
+		r.registerCatalog(ctx, &zone, cluster, primaryPod)
+	}
+
+	serial, _ := r.Exec.ZoneSerial(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
+	zone.Status.Phase = "Ready"
+	zone.Status.Serial = serial
+	zone.Status.RecordCount = int32(recordCount)
+	zone.Status.Signed = zone.Spec.DNSSECPolicyRef != ""
+	zone.Status.ObservedGeneration = zone.Generation
+	setReady(&zone.Status.Conditions, zone.Generation, true, "Provisioned", "zone provisioned on primary")
+	if err := r.Status().Update(ctx, &zone); err != nil {
+		return ctrl.Result{}, err
+	}
+	logger.Info("zone reconciled", "zone", zone.Spec.ZoneName, "serial", serial)
+	return ctrl.Result{RequeueAfter: requeueLong}, nil
+}
+
+// buildZoneConfig renders the inner clause passed to rndc addzone/modzone.
+func (r *BindZoneReconciler) buildZoneConfig(ctx context.Context, zone *bindv1alpha1.BindZone) (string, error) {
+	zType := zone.Spec.Type
+	if zType == "" {
+		zType = bindv1alpha1.ZonePrimary
+	}
+	var parts []string
+	switch zType {
+	case bindv1alpha1.ZonePrimary:
+		parts = append(parts, "type primary", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
+		if zone.Spec.DynamicUpdate && zone.Spec.UpdateKeyRef != "" {
+			parts = append(parts, fmt.Sprintf("allow-update { key \"%s\"; }", updateKeyName(ctx, r.Client, zone)))
+		}
+		if len(zone.Spec.AllowTransfer) > 0 {
+			parts = append(parts, fmt.Sprintf("allow-transfer { %s }", matchListInline(zone.Spec.AllowTransfer)))
+		}
+		if zone.Spec.DNSSECPolicyRef != "" {
+			parts = append(parts, fmt.Sprintf("dnssec-policy \"%s\"", zone.Spec.DNSSECPolicyRef), "inline-signing yes")
+		}
+	case bindv1alpha1.ZoneSecondary:
+		parts = append(parts, "type secondary", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
+		if len(zone.Spec.Primaries) > 0 {
+			parts = append(parts, fmt.Sprintf("primaries { %s }", terminateInline(zone.Spec.Primaries)))
+		}
+	case bindv1alpha1.ZoneForward:
+		parts = append(parts, "type forward", "forward only")
+		if len(zone.Spec.Forwarders) > 0 {
+			parts = append(parts, fmt.Sprintf("forwarders { %s }", terminateInline(zone.Spec.Forwarders)))
+		}
+	case bindv1alpha1.ZoneStub:
+		parts = append(parts, "type stub", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
+		if len(zone.Spec.Primaries) > 0 {
+			parts = append(parts, fmt.Sprintf("primaries { %s }", terminateInline(zone.Spec.Primaries)))
+		}
+	}
+	return "{ " + strings.Join(parts, "; ") + "; };", nil
+}
+
+func (r *BindZoneReconciler) zoneUpdateCreds(ctx context.Context, zone *bindv1alpha1.BindZone) (bind.TSIGCreds, error) {
+	keyRef := zone.Spec.UpdateKeyRef
+	if keyRef == "" {
+		keyRef = zone.Spec.TransferKeyRef
+	}
+	if keyRef == "" {
+		// Fall back to local (non-TSIG) update when the zone allows it; most
+		// seeded primaries permit localhost updates.
+		return bind.TSIGCreds{}, fmt.Errorf("records require spec.updateKeyRef")
+	}
+	return resolveTSIG(ctx, r.Client, zone.Namespace, keyRef)
+}
+
+func (r *BindZoneReconciler) registerCatalog(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster, primaryPod string) {
+	logger := log.FromContext(ctx)
+	catalog, creds, ok := r.catalogFor(ctx, zone, cluster)
+	if !ok {
+		return
+	}
+	if err := r.Exec.AddCatalogMember(ctx, zone.Namespace, primaryPod, catalog.Spec.ZoneName, zone.Spec.ZoneName, creds); err != nil {
+		logger.V(1).Info("catalog register failed", "zone", zone.Spec.ZoneName, "err", err.Error())
+	}
+}
+
+func (r *BindZoneReconciler) deregisterCatalog(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster, primaryPod string) {
+	catalog, creds, ok := r.catalogFor(ctx, zone, cluster)
+	if !ok {
+		return
+	}
+	_ = r.Exec.RemoveCatalogMember(ctx, zone.Namespace, primaryPod, catalog.Spec.ZoneName, zone.Spec.ZoneName, creds)
+}
+
+func (r *BindZoneReconciler) catalogFor(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster) (*bindv1alpha1.BindCatalogZone, bind.TSIGCreds, bool) {
+	var catalogs bindv1alpha1.BindCatalogZoneList
+	if err := r.List(ctx, &catalogs, client.InNamespace(zone.Namespace)); err != nil {
+		return nil, bind.TSIGCreds{}, false
+	}
+	for i := range catalogs.Items {
+		if catalogs.Items[i].Spec.ClusterRef == cluster.Name {
+			cat := &catalogs.Items[i]
+			creds, err := resolveTSIG(ctx, r.Client, zone.Namespace, cat.Spec.TransferKeyRef)
+			if err != nil {
+				return nil, bind.TSIGCreds{}, false
+			}
+			return cat, creds, true
+		}
+	}
+	return nil, bind.TSIGCreds{}, false
+}
+
+func (r *BindZoneReconciler) setPhase(ctx context.Context, zone *bindv1alpha1.BindZone, phase, reason, msg string) (ctrl.Result, error) {
+	zone.Status.Phase = phase
+	zone.Status.ObservedGeneration = zone.Generation
+	setReady(&zone.Status.Conditions, zone.Generation, phase == "Ready", reason, msg)
+	if err := r.Status().Update(ctx, zone); err != nil {
+		return ctrl.Result{}, err
+	}
+	if phase == "Error" || phase == "Pending" {
+		return ctrl.Result{RequeueAfter: requeueShort}, nil
+	}
+	return ctrl.Result{}, nil
+}
+
+func (r *BindZoneReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&bindv1alpha1.BindZone{}).
+		Complete(r)
+}