ungleich-k8s/apps/knotdns

Authoritative DNS for ungleich

• Zone are stored in git

Reload mechansim

Constraints

• If possible stay with the regular/upstream container
  • Rebuilding causes a delay and extra work

Git cloning inside the pod

• It's easy to write a shell script that does git pull && checkzone && reload
• Needs ssh keys or token inside the pods

git clone https://nico:<TOKEN>@gitea.default.svc.c2.k8s.ooo/nico/ungleich-k8s.git

Flux/git repository

TL;DR

This approach does not work because of shortcomings of kubectl/kustomize.

The idea:

• Flux has native support for git pulling
• In theory, k8s has everything in place
• We could generate a configmap from the DNS files (and a configuration file!)
• We can checksum that configmap (helm feature or kustomize hashing)
• Triggers a new deployment
• We can add liveliness checks

Testing config:

apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: dns-zones
  namespace: default
spec:
  interval: 1m
  url: https://code.ungleich.ch/ungleich-intern/ungleich-dns-zones.git
  secretRef:
    name: https-credentials-dnszones
  ref:
    branch: master
---
apiVersion: v1
kind: Secret
metadata:
  name: https-credentials-dnszones
  namespace: default
type: Opaque
stringData:
  username: nico
  password: .....
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: dns-zone-kustomization
  namespace: default
spec:
  interval: 1m
  path: "./"
  prune: true
  sourceRef:
    kind: GitRepository
    name: dns-zones

Using:

kubectl apply -f gitrepo.yaml

This could do everything with the right kustomization.yaml inside the ungleich-dns-zones repository. However there is a problem:

• configmapgenerator cannot use a glob / wildcard

And we have a lot of different zones below the zones/ directory in the ungleich-dns-zones repository.

This in theory very elegant approach only worked if there was an intermediate kustomize edit add configmap configmapname --from-file='./zones/*' in between. However even that would not work, as it includes dotfiles, as can be seen on

https://github.com/kubernetes-sigs/kustomize/issues/4108