Add configuration for CoreDNS and update host variables for lab environment

terraform/modules/apps/coredns/config.tf

@@ -0,0 +1,21 @@
+
+locals {
+  configfile = templatefile("${path.module}/resources/Corefile.tpl", {
+    zones               = var.zones
+    forward_dns_servers = join(" ", var.forward_dns_servers)
+  })
+  configfile_checksum = md5(local.configfile)
+  db_files = {
+    for z in var.zones : z.fqdn => templatefile("${path.module}/resources/db.zone.tpl", {
+      fqdn          = z.fqdn
+      domain_master = z.domain_master
+      timestamp     = formatdate("YYYYMMDD", timestamp())
+      refresh_rate  = z.refresh_rate
+      retry_rate    = z.retry_rate
+      expire_time   = z.expire_time
+      ttl           = z.ttl
+      records       = z.records
+    })
+  }
+  db_files_checksum = md5(jsonencode(local.db_files))
+}

terraform/modules/apps/coredns/main.tf

@@ -0,0 +1,195 @@
+resource "kubernetes_namespace" "dns" {
+  metadata {
+    name = "dns"
+  }
+}
+
+resource "kubernetes_service_account" "dns" {
+
+  metadata {
+    name      = "dns-sa"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "dns" {
+  metadata {
+    name      = "dns-config"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  data = merge({
+    "Corefile" = local.configfile
+
+  }, local.db_files)
+}
+
+resource "kubernetes_deployment" "dns" {
+  metadata {
+    name      = "dns"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+    labels = {
+      dns = "dns"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        dns = "dns"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          dns = "dns"
+        }
+        annotations = {
+          "checksum/corefile" = local.configfile_checksum
+          "checksum/db-files" = local.db_files_checksum
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.dns.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name              = "dns"
+          image             = "docker.io/coredns/coredns:${var.tag}"
+          image_pull_policy = "IfNotPresent"
+          args = [
+            "-conf",
+            "/etc/coredns/Corefile",
+          ]
+
+          liveness_probe {
+            http_get {
+              path   = "/health"
+              port   = 8080
+              scheme = "HTTP"
+            }
+            initial_delay_seconds = 60
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 5
+          }
+
+          readiness_probe {
+            http_get {
+              path   = "/ready"
+              port   = 8181
+              scheme = "HTTP"
+            }
+            period_seconds    = 10
+            success_threshold = 1
+            timeout_seconds   = 1
+          }
+
+          resources {
+            requests = {
+              memory = "100Mi"
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            capabilities {
+              drop = ["ALL"]
+              add  = ["NET_BIND_SERVICE"]
+            }
+          }
+
+          port {
+            name           = "dns-tcp"
+            container_port = 53
+            host_port      = 53
+            protocol       = "TCP"
+          }
+
+          port {
+            name           = "dns-udp"
+            container_port = 53
+            host_port      = 53
+            protocol       = "UDP"
+          }
+
+          port {
+            name           = "metrics"
+            container_port = 9153
+            protocol       = "TCP"
+          }
+
+          volume_mount {
+            name       = "config"
+            mount_path = "/etc/coredns"
+            read_only  = true
+          }
+        }
+
+        volume {
+          name = "config"
+          config_map {
+            name         = kubernetes_config_map.dns.metadata[0].name
+            default_mode = "0644"
+            items {
+              key  = "Corefile"
+              path = "Corefile"
+            }
+            dynamic "items" {
+              for_each = local.db_files
+              content {
+                key  = items.key
+                path = "db.${items.key}"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "dns" {
+  metadata {
+    name      = "dns-ports"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      dns = "dns"
+    }
+
+    port {
+      name        = "dns-tcp"
+      protocol    = "TCP"
+      port        = 53
+      target_port = 53
+    }
+
+    port {
+      name        = "dns-udp"
+      protocol    = "UDP"
+      port        = 53
+      target_port = 53
+    }
+
+    type = "LoadBalancer"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}

terraform/modules/apps/coredns/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/coredns/resources/Corefile.tpl

@@ -0,0 +1,24 @@
+.:53 {
+    errors
+    health {
+      lameduck 5s
+    }
+    ready
+    log . {
+      class error
+    }
+    prometheus :9153
+    forward . ${forward_dns_servers}
+    cache 30
+    loop
+    reload
+    loadbalance
+}
+
+%{ for z in zones ~}
+${z.fqdn}:53 {
+    file /etc/coredns/db.${z.fqdn}
+    log
+    errors
+}
+%{ endfor ~}

terraform/modules/apps/coredns/resources/db.zone.tpl

@@ -0,0 +1,13 @@
+$ORIGIN ${fqdn}.
+@         IN  SOA dns.${fqdn}. ${domain_master}.${fqdn}. (
+              ${timestamp} ; serial
+              ${refresh_rate}     ; refresh
+              ${retry_rate}     ; retry
+              ${expire_time}  ; expire
+              ${ttl} )   ; minimum
+
+          IN  NS  dns.${fqdn}.
+
+%{ for r in records ~}
+${r.name} IN ${r.type} ${r.content}
+%{ endfor ~}

terraform/modules/apps/coredns/variables.tf

@@ -0,0 +1,29 @@
+variable "tag" {
+  description = "The version of app to install"
+  type        = string
+  default     = "latest"
+}
+
+variable "forward_dns_servers" {
+  description = "Forward DNS servers"
+  type        = list(string)
+  default     = ["8.8.8.8", "8.8.4.4"]
+}
+
+variable "zones" {
+  description = "Zones to be managed by coredns"
+  type = list(object({
+    fqdn          = string
+    domain_master = optional(string, "admin")
+    refresh_rate  = optional(number, 7200)
+    retry_rate    = optional(number, 3600)
+    expire_time   = optional(number, 1209600)
+    ttl           = optional(number, 3600)
+    records = list(object({
+      name    = string
+      type    = string
+      content = string
+    }))
+  }))
+  default = []
+}