104 lines
2.2 KiB
YAML
104 lines
2.2 KiB
YAML
---
|
|
# Authoritative masters role (replaces 3x Puppet authoritative servers).
|
|
# Ordinal-0 is the primary holding zone data; the other two replicate via the
|
|
# catalog zone + AXFR/IXFR.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCluster
|
|
metadata:
|
|
name: auth
|
|
namespace: bind-auth
|
|
spec:
|
|
mode: authoritative
|
|
replicas: 3
|
|
storageSize: 2Gi
|
|
service:
|
|
type: LoadBalancer
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindACL
|
|
metadata:
|
|
name: internal-nets
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
entries:
|
|
- 10.0.0.0/8
|
|
- 192.168.0.0/16
|
|
---
|
|
# Catalog zone: new BindZones are auto-provisioned onto the secondaries.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindCatalogZone
|
|
metadata:
|
|
name: auth-catalog
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: catalog.internal
|
|
transferKeyRef: transfer-key
|
|
---
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindDNSSECPolicy
|
|
metadata:
|
|
name: standard
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
algorithm: ecdsap256sha256
|
|
nsec3: true
|
|
csk:
|
|
lifetime: unlimited
|
|
---
|
|
# Forward zone (signed) with a couple of seeded records.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: example-internal
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: internal.example.com
|
|
type: primary
|
|
defaultTTL: 3600
|
|
dnssecPolicyRef: standard
|
|
allowTransfer:
|
|
- key transfer-key
|
|
updateKeyRef: transfer-key
|
|
dynamicUpdate: true
|
|
# Published apex NS, kept in sync on every reconcile. Full names only; an
|
|
# in-zone name (as here) needs its address record below.
|
|
nameservers:
|
|
- ns1.internal.example.com.
|
|
records:
|
|
- name: ns1
|
|
type: A
|
|
values: ["10.0.0.53"]
|
|
- name: www
|
|
type: A
|
|
values: ["10.0.1.10", "10.0.1.11"]
|
|
---
|
|
# Reverse zone for 10.0.0.0/16.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindZone
|
|
metadata:
|
|
name: reverse-10-0
|
|
namespace: bind-auth
|
|
spec:
|
|
clusterRef: auth
|
|
zoneName: 0.10.in-addr.arpa
|
|
type: primary
|
|
updateKeyRef: transfer-key
|
|
dynamicUpdate: true
|
|
allowTransfer:
|
|
- key transfer-key
|
|
records:
|
|
- name: "53.0"
|
|
type: PTR
|
|
values: ["ns1.internal.example.com."]
|