unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
22 lines
638 B
YAML
22 lines
638 B
YAML
---
|
|
# TSIG key used to authenticate zone transfers between primary and secondaries
|
|
# (and catalog zone transfers). The operator generates the material into a
|
|
# Secret named <name>-tsig; the key never appears in the CR.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindTSIGKey
|
|
metadata:
|
|
name: transfer-key
|
|
namespace: bind-auth
|
|
spec:
|
|
algorithm: hmac-sha256
|
|
---
|
|
# TSIG key permitting external-dns (and DNSRecord objects) to send RFC2136
|
|
# dynamic updates to the dynamic cluster's primary.
|
|
apiVersion: bind.unkin.net/v1alpha1
|
|
kind: BindTSIGKey
|
|
metadata:
|
|
name: externaldns-key
|
|
namespace: bind-externaldns
|
|
spec:
|
|
algorithm: hmac-sha256
|