unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
224 lines
8.7 KiB
Go
224 lines
8.7 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
ctrl "sigs.k8s.io/controller-runtime"
|
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
|
|
"sigs.k8s.io/controller-runtime/pkg/log"
|
|
|
|
bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
|
|
"git.unkin.net/unkin/bind-operator/internal/bind"
|
|
)
|
|
|
|
// BindZoneReconciler provisions zones on a cluster primary via rndc addzone and
|
|
// seeds records via dynamic update.
|
|
type BindZoneReconciler struct {
|
|
client.Client
|
|
Scheme *runtime.Scheme
|
|
Exec *bind.Executor
|
|
}
|
|
|
|
// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindzones,verbs=get;list;watch;create;update;patch;delete
|
|
// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindzones/status,verbs=get;update;patch
|
|
// +kubebuilder:rbac:groups=bind.unkin.net,resources=bindcatalogzones;bindtsigkeys,verbs=get;list;watch
|
|
|
|
func (r *BindZoneReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
|
|
logger := log.FromContext(ctx)
|
|
|
|
var zone bindv1alpha1.BindZone
|
|
if err := r.Get(ctx, req.NamespacedName, &zone); err != nil {
|
|
return ctrl.Result{}, client.IgnoreNotFound(err)
|
|
}
|
|
|
|
cluster, err := getCluster(ctx, r.Client, zone.Namespace, zone.Spec.ClusterRef)
|
|
if err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "ClusterMissing", err.Error())
|
|
}
|
|
primaryPod := primaryPodName(cluster.Name)
|
|
|
|
// Handle deletion via finalizer: remove the zone from the primary and catalog.
|
|
if !zone.DeletionTimestamp.IsZero() {
|
|
if controllerutil.ContainsFinalizer(&zone, finalizer) {
|
|
if primaryReady(ctx, r.Client, cluster) && r.Exec != nil {
|
|
_ = r.Exec.DelZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
|
|
r.deregisterCatalog(ctx, &zone, cluster, primaryPod)
|
|
}
|
|
controllerutil.RemoveFinalizer(&zone, finalizer)
|
|
if err := r.Update(ctx, &zone); err != nil {
|
|
return ctrl.Result{}, err
|
|
}
|
|
}
|
|
return ctrl.Result{}, nil
|
|
}
|
|
|
|
if !controllerutil.ContainsFinalizer(&zone, finalizer) {
|
|
controllerutil.AddFinalizer(&zone, finalizer)
|
|
if err := r.Update(ctx, &zone); err != nil {
|
|
return ctrl.Result{}, err
|
|
}
|
|
}
|
|
|
|
if !primaryReady(ctx, r.Client, cluster) || r.Exec == nil {
|
|
return r.setPhase(ctx, &zone, "Pending", "PrimaryNotReady", "waiting for cluster primary to be ready")
|
|
}
|
|
|
|
zoneConfig, err := r.buildZoneConfig(ctx, &zone)
|
|
if err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "ConfigError", err.Error())
|
|
}
|
|
|
|
created := !r.Exec.ZoneExists(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
|
|
if created && zone.Spec.Type == bindv1alpha1.ZonePrimary || (created && zone.Spec.Type == "") {
|
|
if err := r.Exec.WriteSeedZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, bind.ZoneFilePath(zone.Spec.ZoneName), "", 1); err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "SeedFailed", err.Error())
|
|
}
|
|
}
|
|
if err := r.Exec.AddZone(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef, zoneConfig); err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "AddZoneFailed", err.Error())
|
|
}
|
|
|
|
// Seed static records (primary zones only).
|
|
recordCount := 0
|
|
if isPrimaryType(zone.Spec.Type) && len(zone.Spec.Records) > 0 {
|
|
creds, err := r.zoneUpdateCreds(ctx, &zone)
|
|
if err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "NoUpdateKey", err.Error())
|
|
}
|
|
updates := recordsToUpdates(zone.Spec.ZoneName, zone.Spec.Records, zone.Spec.DefaultTTL)
|
|
if err := r.Exec.NSUpdate(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, creds, updates); err != nil {
|
|
return r.setPhase(ctx, &zone, "Error", "RecordUpdateFailed", err.Error())
|
|
}
|
|
recordCount = len(updates)
|
|
}
|
|
|
|
// Register in the catalog so secondaries auto-provision.
|
|
if catalogEnabled(&zone) {
|
|
r.registerCatalog(ctx, &zone, cluster, primaryPod)
|
|
}
|
|
|
|
serial, _ := r.Exec.ZoneSerial(ctx, zone.Namespace, primaryPod, zone.Spec.ZoneName, zone.Spec.ViewRef)
|
|
zone.Status.Phase = "Ready"
|
|
zone.Status.Serial = serial
|
|
zone.Status.RecordCount = int32(recordCount)
|
|
zone.Status.Signed = zone.Spec.DNSSECPolicyRef != ""
|
|
zone.Status.ObservedGeneration = zone.Generation
|
|
setReady(&zone.Status.Conditions, zone.Generation, true, "Provisioned", "zone provisioned on primary")
|
|
if err := r.Status().Update(ctx, &zone); err != nil {
|
|
return ctrl.Result{}, err
|
|
}
|
|
logger.Info("zone reconciled", "zone", zone.Spec.ZoneName, "serial", serial)
|
|
return ctrl.Result{RequeueAfter: requeueLong}, nil
|
|
}
|
|
|
|
// buildZoneConfig renders the inner clause passed to rndc addzone/modzone.
|
|
func (r *BindZoneReconciler) buildZoneConfig(ctx context.Context, zone *bindv1alpha1.BindZone) (string, error) {
|
|
zType := zone.Spec.Type
|
|
if zType == "" {
|
|
zType = bindv1alpha1.ZonePrimary
|
|
}
|
|
var parts []string
|
|
switch zType {
|
|
case bindv1alpha1.ZonePrimary:
|
|
parts = append(parts, "type primary", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
|
|
if zone.Spec.DynamicUpdate && zone.Spec.UpdateKeyRef != "" {
|
|
parts = append(parts, fmt.Sprintf("allow-update { key \"%s\"; }", updateKeyName(ctx, r.Client, zone)))
|
|
}
|
|
if len(zone.Spec.AllowTransfer) > 0 {
|
|
parts = append(parts, fmt.Sprintf("allow-transfer { %s }", matchListInline(zone.Spec.AllowTransfer)))
|
|
}
|
|
if zone.Spec.DNSSECPolicyRef != "" {
|
|
parts = append(parts, fmt.Sprintf("dnssec-policy \"%s\"", zone.Spec.DNSSECPolicyRef), "inline-signing yes")
|
|
}
|
|
case bindv1alpha1.ZoneSecondary:
|
|
parts = append(parts, "type secondary", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
|
|
if len(zone.Spec.Primaries) > 0 {
|
|
parts = append(parts, fmt.Sprintf("primaries { %s }", terminateInline(zone.Spec.Primaries)))
|
|
}
|
|
case bindv1alpha1.ZoneForward:
|
|
parts = append(parts, "type forward", "forward only")
|
|
if len(zone.Spec.Forwarders) > 0 {
|
|
parts = append(parts, fmt.Sprintf("forwarders { %s }", terminateInline(zone.Spec.Forwarders)))
|
|
}
|
|
case bindv1alpha1.ZoneStub:
|
|
parts = append(parts, "type stub", fmt.Sprintf("file \"%s\"", bind.ZoneFilePath(zone.Spec.ZoneName)))
|
|
if len(zone.Spec.Primaries) > 0 {
|
|
parts = append(parts, fmt.Sprintf("primaries { %s }", terminateInline(zone.Spec.Primaries)))
|
|
}
|
|
}
|
|
return "{ " + strings.Join(parts, "; ") + "; };", nil
|
|
}
|
|
|
|
func (r *BindZoneReconciler) zoneUpdateCreds(ctx context.Context, zone *bindv1alpha1.BindZone) (bind.TSIGCreds, error) {
|
|
keyRef := zone.Spec.UpdateKeyRef
|
|
if keyRef == "" {
|
|
keyRef = zone.Spec.TransferKeyRef
|
|
}
|
|
if keyRef == "" {
|
|
// Fall back to local (non-TSIG) update when the zone allows it; most
|
|
// seeded primaries permit localhost updates.
|
|
return bind.TSIGCreds{}, fmt.Errorf("records require spec.updateKeyRef")
|
|
}
|
|
return resolveTSIG(ctx, r.Client, zone.Namespace, keyRef)
|
|
}
|
|
|
|
func (r *BindZoneReconciler) registerCatalog(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster, primaryPod string) {
|
|
logger := log.FromContext(ctx)
|
|
catalog, creds, ok := r.catalogFor(ctx, zone, cluster)
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := r.Exec.AddCatalogMember(ctx, zone.Namespace, primaryPod, catalog.Spec.ZoneName, zone.Spec.ZoneName, creds); err != nil {
|
|
logger.V(1).Info("catalog register failed", "zone", zone.Spec.ZoneName, "err", err.Error())
|
|
}
|
|
}
|
|
|
|
func (r *BindZoneReconciler) deregisterCatalog(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster, primaryPod string) {
|
|
catalog, creds, ok := r.catalogFor(ctx, zone, cluster)
|
|
if !ok {
|
|
return
|
|
}
|
|
_ = r.Exec.RemoveCatalogMember(ctx, zone.Namespace, primaryPod, catalog.Spec.ZoneName, zone.Spec.ZoneName, creds)
|
|
}
|
|
|
|
func (r *BindZoneReconciler) catalogFor(ctx context.Context, zone *bindv1alpha1.BindZone, cluster *bindv1alpha1.BindCluster) (*bindv1alpha1.BindCatalogZone, bind.TSIGCreds, bool) {
|
|
var catalogs bindv1alpha1.BindCatalogZoneList
|
|
if err := r.List(ctx, &catalogs, client.InNamespace(zone.Namespace)); err != nil {
|
|
return nil, bind.TSIGCreds{}, false
|
|
}
|
|
for i := range catalogs.Items {
|
|
if catalogs.Items[i].Spec.ClusterRef == cluster.Name {
|
|
cat := &catalogs.Items[i]
|
|
creds, err := resolveTSIG(ctx, r.Client, zone.Namespace, cat.Spec.TransferKeyRef)
|
|
if err != nil {
|
|
return nil, bind.TSIGCreds{}, false
|
|
}
|
|
return cat, creds, true
|
|
}
|
|
}
|
|
return nil, bind.TSIGCreds{}, false
|
|
}
|
|
|
|
func (r *BindZoneReconciler) setPhase(ctx context.Context, zone *bindv1alpha1.BindZone, phase, reason, msg string) (ctrl.Result, error) {
|
|
zone.Status.Phase = phase
|
|
zone.Status.ObservedGeneration = zone.Generation
|
|
setReady(&zone.Status.Conditions, zone.Generation, phase == "Ready", reason, msg)
|
|
if err := r.Status().Update(ctx, zone); err != nil {
|
|
return ctrl.Result{}, err
|
|
}
|
|
if phase == "Error" || phase == "Pending" {
|
|
return ctrl.Result{RequeueAfter: requeueShort}, nil
|
|
}
|
|
return ctrl.Result{}, nil
|
|
}
|
|
|
|
func (r *BindZoneReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
|
return ctrl.NewControllerManagedBy(mgr).
|
|
For(&bindv1alpha1.BindZone{}).
|
|
Complete(r)
|
|
}
|