records: add domain/IP-range allow+deny filtering #3

2026-07-18T01:59:52+10:00

unkinben commented

2026-07-18 01:59:52 +10:00

Adds allow/deny filtering so k8s and internal addresses stay out of the authoritative zones.

Why

Hosts publish records the authoritative server should not hold — *-flannel.1 A 10.42.x (pod CIDR), *-kube-lb0 A 198.18.200.x (LB VIP range), *-nomad A 172.26.x, plus the matching reverse PTRs (200.18.198, 2.42.10, …). The daemon currently WARNs NOTAUTH/bad authentication on those zones. Filtering drops them at the source.

What

records.Filter: allow/deny CIDRs + allow/deny domain suffixes, applied to the desired set before reconcile.
Range rules match A/AAAA by value and PTR by the address encoded in the reverse-DNS owner, so the junk A record and its reverse PTR drop together. Domain rules match every record by owner. Deny wins; a non-empty allow list means "only these".
Config: -deny-ranges/-allow-ranges/-deny-domains/-allow-domains (comma-separated) or DNS_UPDATER_* env.
Tests cover the real records from the live zone (host A kept, flannel/kube-lb0 dropped, excluded-zone PTRs dropped, legit PTR kept, CNAME untouched, allow-only, domain deny).

Paired puppet change sets DNS_UPDATER_DENY_RANGES=198.18.199.0/24,198.18.200.0/24,10.42.0.0/16,10.43.0.0/16.

Adds allow/deny filtering so k8s and internal addresses stay out of the authoritative zones. ## Why Hosts publish records the authoritative server should not hold — `*-flannel.1 A 10.42.x` (pod CIDR), `*-kube-lb0 A 198.18.200.x` (LB VIP range), `*-nomad A 172.26.x`, plus the matching reverse PTRs (`200.18.198`, `2.42.10`, …). The daemon currently WARNs `NOTAUTH`/`bad authentication` on those zones. Filtering drops them at the source. ## What - `records.Filter`: allow/deny CIDRs + allow/deny domain suffixes, applied to the desired set before reconcile. - Range rules match **A/AAAA by value** and **PTR by the address encoded in the reverse-DNS owner**, so the junk A record and its reverse PTR drop together. Domain rules match every record by owner. Deny wins; a non-empty allow list means "only these". - Config: `-deny-ranges`/`-allow-ranges`/`-deny-domains`/`-allow-domains` (comma-separated) or `DNS_UPDATER_*` env. - Tests cover the real records from the live zone (host A kept, flannel/kube-lb0 dropped, excluded-zone PTRs dropped, legit PTR kept, CNAME untouched, allow-only, domain deny). Paired puppet change sets `DNS_UPDATER_DENY_RANGES=198.18.199.0/24,198.18.200.0/24,10.42.0.0/16,10.43.0.0/16`.

unkinben added 1 commit 2026-07-18 01:59:52 +10:00

records: add domain/IP-range allow+deny filtering

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

194080511c

Adds a Filter (allow/deny CIDRs + allow/deny domain suffixes) applied to the
desired set before reconcile. Range rules match A/AAAA by value and PTR by the
address encoded in the reverse-DNS owner, so both the junk A record and its
reverse PTR are dropped together. Configured via -deny-ranges/-allow-ranges/
-deny-domains/-allow-domains (comma-separated) or DNS_UPDATER_* env.

Purpose: keep k8s pod/service CIDRs, LB VIP ranges and other internal addresses
out of the authoritative zones, and stop NOTAUTH updates for reverse zones the
server does not host (10.42.x, 198.18.200.x, etc.).

benvin merged commit 2d4b3d5b4d into main

2026-07-18 08:28:03 +10:00

benvin deleted branch benvin/record-filters

2026-07-18 08:28:03 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/dns-updater#3