unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
51 lines
1.1 KiB
YAML
51 lines
1.1 KiB
YAML
---
|
|
# Recursive resolvers role (replaces 3x Puppet only-resolver servers).
|
|
# All three pods are identical recursive servers; no zone replication.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: resolver
|
|
namespace: bind-resolver
|
|
spec:
|
|
mode: resolver
|
|
replicas: 3
|
|
service:
|
|
type: LoadBalancer
|
|
forwarders:
|
|
- 1.1.1.1
|
|
- 9.9.9.9
|
|
---
|
|
# Conditional forwarding of an internal zone to the authoritative cluster.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: forward-internal
|
|
namespace: bind-resolver
|
|
spec:
|
|
clusterRef: resolver
|
|
zoneName: internal.example.com
|
|
type: forward
|
|
catalog: false
|
|
forwarders:
|
|
- 10.0.0.53
|
|
---
|
|
# DNS firewall (RPZ) blocklist applied to the resolvers.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindPolicy
|
|
metadata:
|
|
name: blocklist
|
|
namespace: bind-resolver
|
|
spec:
|
|
clusterRef: resolver
|
|
zoneName: rpz.internal
|
|
order: 10
|
|
transferKeyRef: transfer-key
|
|
rules:
|
|
- trigger: qname
|
|
match: malware.example.
|
|
action: nxdomain
|
|
- trigger: qname
|
|
match: tracker.example.
|
|
action: cname
|
|
target: blocked.internal.example.com
|