unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
103 lines
2.1 KiB
YAML
103 lines
2.1 KiB
YAML
---
|
|
# Authoritative masters role (replaces 3x Puppet authoritative servers).
|
|
# Ordinal-0 is the primary holding zone data; the other two replicate via the
|
|
# catalog zone + AXFR/IXFR.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: auth
|
|
namespace: bind-auth
|
|
spec:
|
|
mode: authoritative
|
|
replicas: 3
|
|
storageSize: 2Gi
|
|
service:
|
|
type: LoadBalancer
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: internal-nets
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
entries:
|
|
- 10.0.0.0/8
|
|
- 192.168.0.0/16
|
|
---
|
|
# Catalog zone: new BindZones are auto-provisioned onto the secondaries.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCatalogZone
|
|
metadata:
|
|
name: auth-catalog
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: catalog.internal
|
|
transferKeyRef: transfer-key
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindDNSSECPolicy
|
|
metadata:
|
|
name: standard
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
algorithm: ecdsap256sha256
|
|
nsec3: true
|
|
csk:
|
|
lifetime: unlimited
|
|
---
|
|
# Forward zone (signed) with a couple of seeded records.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: example-internal
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: internal.example.com
|
|
type: primary
|
|
defaultTTL: 3600
|
|
dnssecPolicyRef: standard
|
|
allowTransfer:
|
|
- key transfer-key
|
|
updateKeyRef: transfer-key
|
|
dynamicUpdate: true
|
|
records:
|
|
- name: "@"
|
|
type: NS
|
|
values: ["ns1.internal.example.com."]
|
|
- name: ns1
|
|
type: A
|
|
values: ["10.0.0.53"]
|
|
- name: www
|
|
type: A
|
|
values: ["10.0.1.10", "10.0.1.11"]
|
|
---
|
|
# Reverse zone for 10.0.0.0/16.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: reverse-10-0
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: 0.10.in-addr.arpa
|
|
type: primary
|
|
updateKeyRef: transfer-key
|
|
dynamicUpdate: true
|
|
allowTransfer:
|
|
- key transfer-key
|
|
records:
|
|
- name: "53.0"
|
|
type: PTR
|
|
values: ["ns1.internal.example.com."]
|