Port DNS charts
This commit is contained in:
parent
56e28b1b47
commit
4d11768bbf
11 changed files with 357 additions and 28 deletions
0
charts/dns/Chart.yaml
Normal file
0
charts/dns/Chart.yaml
Normal file
136
charts/dns/templates/bind-master.yaml
Normal file
136
charts/dns/templates/bind-master.yaml
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: bind-master-config
|
||||
data:
|
||||
named.conf: |
|
||||
include "/etc/bind/externaldns-key.conf";
|
||||
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
|
||||
recursion yes;
|
||||
allow-query { any; };
|
||||
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { any; };
|
||||
|
||||
forwarders {
|
||||
10.40.0.254;
|
||||
};
|
||||
|
||||
dnssec-validation auto;
|
||||
};
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/usr/share/dns/root.hints";
|
||||
};
|
||||
|
||||
zone "hxme.net." IN {
|
||||
type master;
|
||||
file "/etc/bind/db.hxme.net";
|
||||
allow-update { key "externaldns-key"; };
|
||||
};
|
||||
db.hxme.net: |
|
||||
$TTL 3600
|
||||
@ IN SOA ns1.hxme.net. admin.hxme.net. (
|
||||
1 ; Serial
|
||||
7200 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Negative Cache TTL
|
||||
;
|
||||
@ IN NS ns1.hxme.net.
|
||||
ns1 IN A 10.40.0.110
|
||||
@ IN A 10.40.0.110
|
||||
www IN A 10.40.0.110
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: bind-master
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bind-master
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bind-master
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
initContainers:
|
||||
- name: fetch-root-hints
|
||||
image: debian:12
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
apt update && apt -y install curl
|
||||
curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
|
||||
volumeMounts:
|
||||
- mountPath: /usr/share/dns
|
||||
name: root-hints
|
||||
containers:
|
||||
- name: bind-master
|
||||
image: internetsystemsconsortium/bind9:9.18
|
||||
command: ["named", "-g", "-c", "/etc/bind/named.conf"]
|
||||
ports:
|
||||
- containerPort: 53
|
||||
protocol: UDP
|
||||
- containerPort: 53
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/bind/named.conf
|
||||
subPath: named.conf
|
||||
- name: config
|
||||
mountPath: /etc/bind/db.hxme.net
|
||||
subPath: db.hxme.net
|
||||
- name: dns-secrets
|
||||
mountPath: /etc/bind/externaldns-key.conf
|
||||
subPath: externaldns-key.conf
|
||||
- name: bind-cache
|
||||
mountPath: /var/cache/bind
|
||||
- name: bind-rundir
|
||||
mountPath: /var/run/named
|
||||
- name: root-hints
|
||||
mountPath: /usr/share/dns
|
||||
volumes:
|
||||
- name: dns-secrets
|
||||
secret:
|
||||
secretName: dns-secrets
|
||||
- name: config
|
||||
configMap:
|
||||
name: bind-master-config
|
||||
- name: bind-cache
|
||||
emptyDir: {}
|
||||
- name: bind-rundir
|
||||
emptyDir: {}
|
||||
- name: root-hints
|
||||
emptyDir: {}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: bind-master
|
||||
spec:
|
||||
selector:
|
||||
app: bind-master
|
||||
ports:
|
||||
- name: dns-udp
|
||||
port: 53
|
||||
protocol: UDP
|
||||
targetPort: 53
|
||||
- name: dns-tcp
|
||||
port: 53
|
||||
protocol: TCP
|
||||
targetPort: 53
|
||||
|
||||
|
||||
136
charts/dns/templates/bind-slave.yaml
Normal file
136
charts/dns/templates/bind-slave.yaml
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: bind-slave-config
|
||||
data:
|
||||
named.conf: |
|
||||
include "/etc/bind/externaldns-key.conf";
|
||||
|
||||
options {
|
||||
directory "/var/cache/bind";
|
||||
|
||||
recursion yes;
|
||||
allow-query { any; };
|
||||
|
||||
listen-on port 53 { any; };
|
||||
listen-on-v6 port 53 { any; };
|
||||
|
||||
forwarders {
|
||||
10.40.0.254;
|
||||
};
|
||||
|
||||
dnssec-validation auto;
|
||||
};
|
||||
|
||||
zone "." IN {
|
||||
type hint;
|
||||
file "/usr/share/dns/root.hints";
|
||||
};
|
||||
|
||||
zone "hxme.net." IN {
|
||||
type master;
|
||||
file "/etc/bind/db.hxme.net";
|
||||
allow-update { key "externaldns-key"; };
|
||||
};
|
||||
db.hxme.net: |
|
||||
$TTL 3600
|
||||
@ IN SOA ns1.hxme.net. admin.hxme.net. (
|
||||
1 ; Serial
|
||||
7200 ; Refresh
|
||||
1800 ; Retry
|
||||
1209600 ; Expire
|
||||
86400 ) ; Negative Cache TTL
|
||||
;
|
||||
@ IN NS ns1.hxme.net.
|
||||
ns1 IN A 10.40.0.110
|
||||
@ IN A 10.40.0.110
|
||||
www IN A 10.40.0.110
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: bind-slave
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bind-slave
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bind-slave
|
||||
spec:
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
initContainers:
|
||||
- name: fetch-root-hints
|
||||
image: debian:12
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
apt update && apt -y install curl
|
||||
curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
|
||||
volumeMounts:
|
||||
- mountPath: /usr/share/dns
|
||||
name: root-hints
|
||||
containers:
|
||||
- name: bind-slave
|
||||
image: internetsystemsconsortium/bind9:9.18
|
||||
command: ["named", "-g", "-c", "/etc/bind/named.conf"]
|
||||
ports:
|
||||
- containerPort: 53
|
||||
protocol: UDP
|
||||
- containerPort: 53
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/bind/named.conf
|
||||
subPath: named.conf
|
||||
- name: config
|
||||
mountPath: /etc/bind/db.hxme.net
|
||||
subPath: db.hxme.net
|
||||
- name: dns-secrets
|
||||
mountPath: /etc/bind/externaldns-key.conf
|
||||
subPath: externaldns-key.conf
|
||||
- name: bind-cache
|
||||
mountPath: /var/cache/bind
|
||||
- name: bind-rundir
|
||||
mountPath: /var/run/named
|
||||
- name: root-hints
|
||||
mountPath: /usr/share/dns
|
||||
volumes:
|
||||
- name: dns-secrets
|
||||
secret:
|
||||
secretName: dns-secrets
|
||||
- name: config
|
||||
configMap:
|
||||
name: bind-slave-config
|
||||
- name: bind-cache
|
||||
emptyDir: {}
|
||||
- name: bind-rundir
|
||||
emptyDir: {}
|
||||
- name: root-hints
|
||||
emptyDir: {}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: bind-slave
|
||||
spec:
|
||||
selector:
|
||||
app: bind-slave
|
||||
ports:
|
||||
- name: dns-udp
|
||||
port: 53
|
||||
protocol: UDP
|
||||
targetPort: 53
|
||||
- name: dns-tcp
|
||||
port: 53
|
||||
protocol: TCP
|
||||
targetPort: 53
|
||||
|
||||
|
||||
72
charts/dns/templates/externaldns.yaml
Normal file
72
charts/dns/templates/externaldns.yaml
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-dns
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services","endpoints","pods"]
|
||||
verbs: ["get","watch","list"]
|
||||
- apiGroups: ["extensions","networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get","watch","list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["list","watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: external-dns-viewer
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: external-dns
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: external-dns
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: external-dns
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: external-dns
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: external-dns
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: external-dns
|
||||
spec:
|
||||
serviceAccountName: external-dns
|
||||
containers:
|
||||
- name: external-dns
|
||||
image: bitnami/external-dns:latest
|
||||
args:
|
||||
- --source=service
|
||||
- --source=ingress
|
||||
- --provider=rfc2136
|
||||
- --rfc2136-host=bind-master.dns.svc.cluster.local
|
||||
- --rfc2136-port=53
|
||||
- --rfc2136-zone=hxme.net
|
||||
- --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
|
||||
- --rfc2136-tsig-secret-alg=hmac-sha256
|
||||
- --rfc2136-tsig-keyname=externaldns-key
|
||||
- --policy=sync
|
||||
- --registry=txt
|
||||
- --txt-owner-id=my-cluster
|
||||
env:
|
||||
- name: RFC2136_TSIG_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: dns-secrets
|
||||
key: externaldns-secret
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue