Scaffold kea-operator: CRDs, controllers, HA rendering, REST API, CI #1

2026-08-02T18:43:08+10:00

unkinben commented

2026-08-02 18:43:08 +10:00

Replace the ISC dhcpd VM (used solely for PXE-booting physical hosts) with a Kea DHCP Kubernetes operator, modelled on bind-operator. This is the initial scaffold: fully building, go test -race green.

add CRDs (group kea.unkin.net/v1alpha1): KeaCluster, KeaSubnet, KeaClientClass, KeaAPI
render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf from the CRs into a ConfigMap, roll the StatefulSet via a config-hash pod annotation, and best-effort hot-reload ready pods through the kea-ctrl-agent REST channel
run HA in hot-standby with memfile leases on a StatefulSet for stable per-peer identity (ordinal-derived this-server-name, headless-DNS peer URLs, no pod IPs in the config); expose an anycast LoadBalancer Service for PureLB
translate the legacy dhcpd config in samples: the 198.18.13-17.0/24 PXE pools and the Legacy/UEFI-64 PXE arch classes (option 93); the CRD/renderer also support pool-less subnets (with unit tests)
spawn a Terraform-friendly REST API (KeaAPI) doing bearer-token CRUD over subnet/client-class CRs (stable name IDs, PUT upsert, 404 drift)
add Makefile (patch/minor/major tag targets), distroless operator/api images, an AlmaLinux+EPEL kea workload image, and woodpecker CI (lint/test/build on PR, image publish on v* tags) with k8s resources + serviceAccountName on every step
unit tests for config rendering, controller reconcile + config-hash, and the REST API

Follow-ups (separate/queued): argocd-apps kea-operator-ci ServiceAccount + deployment; artifactapi EPEL rpm remote if CI cannot reach EPEL; terraform-provider-kea; Vault-issued API tokens; anycast VIP pinning to the active HA peer.

Replace the ISC dhcpd VM (used solely for PXE-booting physical hosts) with a Kea DHCP Kubernetes operator, modelled on bind-operator. This is the initial scaffold: fully building, `go test -race` green. - add CRDs (group `kea.unkin.net/v1alpha1`): KeaCluster, KeaSubnet, KeaClientClass, KeaAPI - render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf from the CRs into a ConfigMap, roll the StatefulSet via a config-hash pod annotation, and best-effort hot-reload ready pods through the kea-ctrl-agent REST channel - run HA in hot-standby with memfile leases on a StatefulSet for stable per-peer identity (ordinal-derived this-server-name, headless-DNS peer URLs, no pod IPs in the config); expose an anycast LoadBalancer Service for PureLB - translate the legacy dhcpd config in samples: the 198.18.13-17.0/24 PXE pools and the Legacy/UEFI-64 PXE arch classes (option 93); the CRD/renderer also support pool-less subnets (with unit tests) - spawn a Terraform-friendly REST API (KeaAPI) doing bearer-token CRUD over subnet/client-class CRs (stable name IDs, PUT upsert, 404 drift) - add Makefile (patch/minor/major tag targets), distroless operator/api images, an AlmaLinux+EPEL kea workload image, and woodpecker CI (lint/test/build on PR, image publish on v* tags) with k8s resources + serviceAccountName on every step - unit tests for config rendering, controller reconcile + config-hash, and the REST API Follow-ups (separate/queued): argocd-apps kea-operator-ci ServiceAccount + deployment; artifactapi EPEL rpm remote if CI cannot reach EPEL; terraform-provider-kea; Vault-issued API tokens; anycast VIP pinning to the active HA peer.

unkinben added 1 commit 2026-08-02 18:43:08 +10:00

Scaffold kea-operator: CRDs, controllers, config rendering, REST API, CI

ci/woodpecker/pr/build Pipeline failed

Details

ci/woodpecker/pr/pre-commit Pipeline failed

Details

ci/woodpecker/pr/test Pipeline failed

Details

d3fb5dcd1a

Replace the ISC dhcpd PXE-boot VM with a Kea DHCP Kubernetes operator, modelled
on bind-operator. The operator renders kea-dhcp4 config from CRs and runs an HA
pair of kea-dhcp4 + kea-ctrl-agent servers behind an anycast Service.

- add KeaCluster/KeaSubnet/KeaClientClass/KeaAPI CRDs (group kea.unkin.net)
- render deterministic kea-dhcp4.conf + kea-ctrl-agent.conf into a ConfigMap and
  roll the StatefulSet via a config-hash annotation; best-effort hot-reload via
  the kea-ctrl-agent REST channel
- run HA hot-standby (memfile leases) with stable per-peer DNS identity from a
  StatefulSet; expose an anycast LoadBalancer Service for PureLB
- represent the full legacy dhcpd config: 198.18.13-17.0/24 pools, pool-less
  198.18.25.0/24, and the Legacy/UEFI-64 PXE arch classes (option 93)
- add the KeaAPI-spawned REST service: Terraform-friendly CRUD over subnet and
  client-class CRs (stable IDs, PUT upsert, 404 drift, bearer-token auth)
- add Makefile (patch/minor/major tag targets), distroless operator/api images,
  an AlmaLinux+EPEL kea workload image, and woodpecker CI with k8s resources +
  serviceAccountName on every step
- unit tests for config rendering, controller reconcile/config-hash, and the API

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

unkinben added 1 commit 2026-08-02 19:02:15 +10:00

Drop the pool-less 198.18.25.0/24 subnet from the migration samples

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

4f2567f5ba

The 'local' subnet is not needed in the kea migration. Remove it from the ISC
translation sample; the pool-less-subnet capability and its unit tests remain.

- remove net-198-18-25 KeaSubnet from config/samples/01-subnets.yaml

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

benvin merged commit 06ef0ce48b into main

2026-08-02 19:29:49 +10:00

benvin deleted branch benvin/initial

2026-08-02 19:29:50 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/kea-operator#1