unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
35 lines
901 B
Go
35 lines
901 B
Go
package bind
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"fmt"
|
|
)
|
|
|
|
// GenerateSecret returns a base64-encoded cryptographically-random key of n
|
|
// bytes, suitable for a TSIG or rndc HMAC secret.
|
|
func GenerateSecret(n int) (string, error) {
|
|
buf := make([]byte, n)
|
|
if _, err := rand.Read(buf); err != nil {
|
|
return "", fmt.Errorf("read random: %w", err)
|
|
}
|
|
return base64.StdEncoding.EncodeToString(buf), nil
|
|
}
|
|
|
|
// KeyClause renders a named.conf `key` block for inclusion.
|
|
func KeyClause(name, algorithm, secret string) string {
|
|
return fmt.Sprintf("key \"%s\" {\n algorithm %s;\n secret \"%s\";\n};\n", name, algorithm, secret)
|
|
}
|
|
|
|
// SecretBytesForAlgorithm returns a reasonable key length for a TSIG algorithm.
|
|
func SecretBytesForAlgorithm(algorithm string) int {
|
|
switch algorithm {
|
|
case "hmac-sha512", "hmac-sha384":
|
|
return 64
|
|
case "hmac-sha256":
|
|
return 32
|
|
default:
|
|
return 32
|
|
}
|
|
}
|