unkinben
fe5fbdaf6d
Implements a Kubernetes operator that manages fleets of BIND9 servers declaratively, using controller-runtime (matching forgebot conventions). - add BindCluster reconciler: StatefulSet (pod-0 primary, secondaries), headless + client Services, rendered named.conf ConfigMap, TSIG keys Secret and rndc control Secret; watches dependent CRs to re-render - add BindTSIGKey reconciler that generates key material into a Secret - add BindZone/DNSRecord reconcilers using fully-dynamic delivery (rndc addzone + TSIG nsupdate against the primary pod) - add BindCatalogZone reconciler so secondaries auto-provision zones - add BindPolicy (RPZ), BindDNSSECPolicy, BindView, BindACL reconcilers - render primary/secondary named.conf variants selected by pod ordinal - generate CRDs, deepcopy and RBAC; add samples mapping the three Puppet roles (authoritative/resolver/external-dns) to three BindClusters - add Makefile, Dockerfile.operator, Woodpecker CI and kind manifests
112 lines
3.2 KiB
Go
112 lines
3.2 KiB
Go
package controller
|
|
|
|
import (
|
|
"context"
|
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
"k8s.io/apimachinery/pkg/util/intstr"
|
|
ctrl "sigs.k8s.io/controller-runtime"
|
|
|
|
bindv1alpha1 "git.unkin.net/unkin/bind-operator/api/v1alpha1"
|
|
)
|
|
|
|
func intstrFromInt(i int) intstr.IntOrString { return intstr.FromInt(i) }
|
|
|
|
func podReady(pod *corev1.Pod) bool {
|
|
for _, c := range pod.Status.Conditions {
|
|
if c.Type == corev1.PodReady {
|
|
return c.Status == corev1.ConditionTrue
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// entrypointScript selects the primary or secondary named.conf based on the
|
|
// pod's StatefulSet ordinal and launches named in the foreground.
|
|
func entrypointScript() string {
|
|
return `#!/bin/sh
|
|
set -eu
|
|
ORD="${HOSTNAME##*-}"
|
|
if [ "$ORD" = "0" ]; then
|
|
cp /etc/bind/named.conf.primary /run/named/named.conf
|
|
else
|
|
cp /etc/bind/named.conf.secondary /run/named/named.conf
|
|
fi
|
|
mkdir -p /var/lib/named/zones /var/lib/named/catalog
|
|
exec named -g -c /run/named/named.conf
|
|
`
|
|
}
|
|
|
|
func (r *BindClusterReconciler) upsertService(ctx context.Context, c *bindv1alpha1.BindCluster, desired *corev1.Service) error {
|
|
if err := ctrl.SetControllerReference(c, desired, r.Scheme); err != nil {
|
|
return err
|
|
}
|
|
var existing corev1.Service
|
|
err := r.Get(ctx, types.NamespacedName{Namespace: desired.Namespace, Name: desired.Name}, &existing)
|
|
if apierrors.IsNotFound(err) {
|
|
return r.Create(ctx, desired)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
existing.Spec.Ports = desired.Spec.Ports
|
|
existing.Spec.Selector = desired.Spec.Selector
|
|
existing.Spec.Type = desired.Spec.Type
|
|
existing.Spec.LoadBalancerIP = desired.Spec.LoadBalancerIP
|
|
if desired.Annotations != nil {
|
|
if existing.Annotations == nil {
|
|
existing.Annotations = map[string]string{}
|
|
}
|
|
for k, v := range desired.Annotations {
|
|
existing.Annotations[k] = v
|
|
}
|
|
}
|
|
return r.Update(ctx, &existing)
|
|
}
|
|
|
|
func (r *BindClusterReconciler) upsertConfigMap(ctx context.Context, c *bindv1alpha1.BindCluster, name string, data map[string]string) error {
|
|
desired := &corev1.ConfigMap{}
|
|
desired.Name = name
|
|
desired.Namespace = c.Namespace
|
|
desired.Labels = commonLabels(c.Name)
|
|
desired.Data = data
|
|
if err := ctrl.SetControllerReference(c, desired, r.Scheme); err != nil {
|
|
return err
|
|
}
|
|
var existing corev1.ConfigMap
|
|
err := r.Get(ctx, types.NamespacedName{Namespace: c.Namespace, Name: name}, &existing)
|
|
if apierrors.IsNotFound(err) {
|
|
return r.Create(ctx, desired)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
existing.Data = data
|
|
existing.Labels = commonLabels(c.Name)
|
|
return r.Update(ctx, &existing)
|
|
}
|
|
|
|
func (r *BindClusterReconciler) upsertSecret(ctx context.Context, c *bindv1alpha1.BindCluster, name string, data map[string][]byte) error {
|
|
desired := &corev1.Secret{}
|
|
desired.Name = name
|
|
desired.Namespace = c.Namespace
|
|
desired.Labels = commonLabels(c.Name)
|
|
desired.Data = data
|
|
if err := ctrl.SetControllerReference(c, desired, r.Scheme); err != nil {
|
|
return err
|
|
}
|
|
var existing corev1.Secret
|
|
err := r.Get(ctx, types.NamespacedName{Namespace: c.Namespace, Name: name}, &existing)
|
|
if apierrors.IsNotFound(err) {
|
|
return r.Create(ctx, desired)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
existing.Data = data
|
|
existing.Labels = commonLabels(c.Name)
|
|
return r.Update(ctx, &existing)
|
|
}
|