---
# Recursive resolvers role (replaces 3x Puppet only-resolver servers).
# All three pods are identical recursive servers; no zone replication.
apiVersion: bind.unkin.net/v1alpha1
kind: BindCluster
metadata:
  name: resolver
  namespace: bind-resolver
spec:
  mode: resolver
  replicas: 3
  service:
    type: LoadBalancer
  forwarders:
    - 1.1.1.1
    - 9.9.9.9
---
# Conditional forwarding of an internal zone to the authoritative cluster.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: forward-internal
  namespace: bind-resolver
spec:
  clusterRef: resolver
  zoneName: internal.example.com
  type: forward
  catalog: false
  forwarders:
    - 10.0.0.53
---
# DNS firewall (RPZ) blocklist applied to the resolvers.
apiVersion: bind.unkin.net/v1alpha1
kind: BindPolicy
metadata:
  name: blocklist
  namespace: bind-resolver
spec:
  clusterRef: resolver
  zoneName: rpz.internal
  order: 10
  transferKeyRef: transfer-key
  rules:
    - trigger: qname
      match: malware.example.
      action: nxdomain
    - trigger: qname
      match: tracker.example.
      action: cname
      target: blocked.internal.example.com