DNSZone

DNSZone is a recorded grant of authority over a name space: the stone kept in the temple.


API version	`kudurru.io/v1alpha1`
Kind	`DNSZone`
Scope	Cluster
Resource	`dnszones.kudurru.io`
Short names	`zone`
Subresources	`status`

Columns of kubectl get dnszones:

Column	Type	Value
ZONE	string	`.spec.zoneName`
TYPE	string	`.spec.type`
SERIAL	integer	`.status.serial`
RECORDS	integer	`.status.recordCount`
READY	string	`.status.conditions[?(@.type=="Ready")].status`
AGE	date	`.metadata.creationTimestamp`

Spec

DNSZoneSpec defines the desired state of a zone.

Field	Type	Description
`spec.defaultTTL`	`integer`	Default: `300` Format: `int32`
`spec.dnssec`	`object`	DNSSECSpec is reserved for v1.0 signing. The schema exists so that the seam is in place (docs/architecture.md §13.1).
`spec.dnssec.algorithm`	`string`	Default: `ECDSAP256SHA256` One of: `ECDSAP256SHA256`, `ED25519`
`spec.dnssec.denial`	`string`	Default: `nsec` One of: `nsec`, `nsec3`
`spec.dnssec.enabled`	`boolean`	Required.
`spec.dnssec.keySecretRef`	`object`	ObjectRef points at another kudurru object. Namespace is omitted for cluster-scoped kinds and for same-namespace references.
`spec.dnssec.keySecretRef.name`	`string`	Required. Length: at least 1
`spec.dnssec.keySecretRef.namespace`	`string`
`spec.external`	`object`	ExternalSpec synthesises records from Kubernetes objects (v0.2).
`spec.external.gateway`	`boolean`
`spec.external.ingress`	`boolean`
`spec.external.loadBalancerServices`	`boolean`
`spec.forward`	`object`	ForwardSpec configures a forward zone.
`spec.forward.dnssecValidation`	`boolean`
`spec.forward.upstreamGroup`	`string`	UpstreamGroup names a group in the Kudurru settings. Default: `default`
`spec.nameservers`	`[]string`
`spec.policy`	`object`	ZonePolicy controls who may query, transfer, be notified about and update the zone.
`spec.policy.notify`	`string`	NotifyMode selects where NOTIFY messages are sent on serial change. Default: `none` One of: `none`, `zoneNameServers`, `specified`, `both`
`spec.policy.notifyTargets`	`[]string`
`spec.policy.queryACL`	`[]string`	QueryACL entries are CIDRs, optionally negated with a leading "!". Ordered, first match wins, default deny.
`spec.policy.queryAccess`	`string`	AccessMode is Technitium's six-way access vocabulary applied to queries, transfers and dynamic updates. Default: `allow` One of: `deny`, `allow`, `allowOnlyPrivate`, `allowOnlyZoneNameServers`, `useNetworkACL`, `zoneNameServersAndACL`
`spec.policy.transferACL`	`[]string`
`spec.policy.transferTSIGKeyRefs`	`[]string`
`spec.policy.update`	`string`	Update controls RFC 2136 dynamic updates (v0.2). Default: `deny` One of: `deny`, `allow`, `allowOnlyPrivate`, `allowOnlyZoneNameServers`, `useNetworkACL`, `zoneNameServersAndACL`
`spec.policy.updatePolicies`	`[]object`
`spec.policy.updatePolicies[].name`	`string`	Required. Name is an owner name or wildcard pattern within the zone.
`spec.policy.updatePolicies[].tsigKeyRef`	`string`	Required.
`spec.policy.updatePolicies[].types`	`[]string`
`spec.policy.zoneTransfer`	`string`	AccessMode is Technitium's six-way access vocabulary applied to queries, transfers and dynamic updates. Default: `deny` One of: `deny`, `allow`, `allowOnlyPrivate`, `allowOnlyZoneNameServers`, `useNetworkACL`, `zoneNameServersAndACL`
`spec.publish`	`[]object`
`spec.publish[].integrationRef`	`object`	Required. ObjectRef points at another kudurru object. Namespace is omitted for cluster-scoped kinds and for same-namespace references.
`spec.publish[].integrationRef.name`	`string`	Required. Length: at least 1
`spec.publish[].integrationRef.namespace`	`string`
`spec.publish[].policy`	`string`	Default: `sync` One of: `sync`, `upsert-only`, `create-only`
`spec.publish[].selector`	`object`	A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
`spec.publish[].selector.matchExpressions`	`[]object`	matchExpressions is a list of label selector requirements. The requirements are ANDed.
`spec.publish[].selector.matchExpressions[].key`	`string`	Required. key is the label key that the selector applies to.
`spec.publish[].selector.matchExpressions[].operator`	`string`	Required. operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
`spec.publish[].selector.matchExpressions[].values`	`[]string`	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
`spec.publish[].selector.matchLabels`	`map[string]string`	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
`spec.publish[].types`	`[]string`
`spec.recordSetSelector`	`object`	RecordSetSelector restricts which DNSRecordSets may add records to the zone.
`spec.recordSetSelector.labelSelector`	`object`	A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
`spec.recordSetSelector.labelSelector.matchExpressions`	`[]object`	matchExpressions is a list of label selector requirements. The requirements are ANDed.
`spec.recordSetSelector.labelSelector.matchExpressions[].key`	`string`	Required. key is the label key that the selector applies to.
`spec.recordSetSelector.labelSelector.matchExpressions[].operator`	`string`	Required. operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
`spec.recordSetSelector.labelSelector.matchExpressions[].values`	`[]string`	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
`spec.recordSetSelector.labelSelector.matchLabels`	`map[string]string`	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
`spec.recordSetSelector.namespaces`	`[]string`
`spec.secondary`	`object`	SecondarySpec configures a secondary zone (v0.2).
`spec.secondary.primaries`	`[]string`	Required.
`spec.secondary.transferProtocol`	`string`	Default: `tcp` One of: `tcp`, `tls`
`spec.secondary.tsigKeyRef`	`string`
`spec.soa`	`object`	SOASpec holds the SOA fields the operator controls. The serial is computed by the leader and lives in status (decision D12).
`spec.soa.expire`	`integer`	Default: `1209600` Format: `int32`
`spec.soa.minimum`	`integer`	Default: `300` Format: `int32`
`spec.soa.mname`	`string`
`spec.soa.refresh`	`integer`	Default: `3600` Format: `int32`
`spec.soa.retry`	`integer`	Default: `900` Format: `int32`
`spec.soa.rname`	`string`
`spec.stub`	`object`	StubSpec configures a stub zone (v0.2).
`spec.stub.nameservers`	`[]string`	Required.
`spec.type`	`string`	Required. ZoneType selects how a zone gets its data. One of: `primary`, `forward`, `secondary`, `stub`, `external`, `catalog`, `secondaryCatalog`
`spec.zoneName`	`string`	Required. ZoneName is the fully qualified zone name with a trailing dot. Pattern: `^([a-zA-Z0-9_-]+\.)*$\|^\.$` Length: at least 1 Validation: zoneName is immutable (`self == oldSelf`)

Status

DNSZoneStatus is the observed state of a zone.

Field	Type	Description
`status.conditions`	`[]Condition`	List type: `map`, keyed by `type`
`status.contentHash`	`string`	ContentHash is the sha256 of the canonical RRsets.
`status.nameserverAddresses`	`[]string`
`status.observedGeneration`	`integer`	Format: `int64`
`status.published`	`[]object`
`status.published[].conflicts`	`integer`
`status.published[].drift`	`integer`
`status.published[].integration`	`string`	Required.
`status.published[].lastSyncTime`	`string`	Format: `date-time`
`status.published[].managed`	`integer`
`status.recordCount`	`integer`
`status.serial`	`integer`	Serial is stamped by the leader as max(prev+1, unix_now) whenever ContentHash changes. Replicas serve this value. Format: `int32`

Example

config/samples/kudurru.io_v1alpha1_dnszone.yaml:

apiVersion: kudurru.io/v1alpha1
kind: DNSZone
metadata:
  name: home-example-com
spec:
  zoneName: home.example.com.
  type: primary
  soa:
    mname: ns1.home.example.com.
    rname: hostmaster.example.com.
    refresh: 3600
    retry: 900
    expire: 1209600
    minimum: 300
  nameservers: [ns1.home.example.com., ns2.home.example.com.]
  policy:
    queryAccess: allow
    zoneTransfer: useNetworkACL
    transferACL: ["10.0.0.0/8"]
    notify: zoneNameServers
    update: deny
  recordSetSelector:
    namespaces: [dns, apps]
  # v0.2 split-horizon: publish labelled records to a Cloudflare sink.
  # publish:
  #   - integrationRef: { name: cf-public, namespace: dns }
  #     selector: { matchLabels: { kudurru.io/publish: cloudflare } }
  #     types: [A, AAAA, CNAME, TXT, MX, SRV, CAA]
  #     policy: sync