Add configuration for CoreDNS and update host variables for lab environment

2025-06-07 16:12:55 +02:00
parent d3b8aff1ae
commit 3cda0b5624
18 changed files with 425 additions and 44 deletions
@@ -0,0 +1,195 @@
+resource "kubernetes_namespace" "dns" {
+  metadata {
+    name = "dns"
+  }
+}
+
+resource "kubernetes_service_account" "dns" {
+
+  metadata {
+    name      = "dns-sa"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "dns" {
+  metadata {
+    name      = "dns-config"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  data = merge({
+    "Corefile" = local.configfile
+
+  }, local.db_files)
+}
+
+resource "kubernetes_deployment" "dns" {
+  metadata {
+    name      = "dns"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+    labels = {
+      dns = "dns"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        dns = "dns"
+      }
+    }
+
+    strategy {
+      type = "RollingUpdate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          dns = "dns"
+        }
+        annotations = {
+          "checksum/corefile" = local.configfile_checksum
+          "checksum/db-files" = local.db_files_checksum
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.dns.metadata[0].name
+        automount_service_account_token = false
+
+        container {
+          name              = "dns"
+          image             = "docker.io/coredns/coredns:${var.tag}"
+          image_pull_policy = "IfNotPresent"
+          args = [
+            "-conf",
+            "/etc/coredns/Corefile",
+          ]
+
+          liveness_probe {
+            http_get {
+              path   = "/health"
+              port   = 8080
+              scheme = "HTTP"
+            }
+            initial_delay_seconds = 60
+            period_seconds        = 10
+            success_threshold     = 1
+            timeout_seconds       = 5
+          }
+
+          readiness_probe {
+            http_get {
+              path   = "/ready"
+              port   = 8181
+              scheme = "HTTP"
+            }
+            period_seconds    = 10
+            success_threshold = 1
+            timeout_seconds   = 1
+          }
+
+          resources {
+            requests = {
+              memory = "100Mi"
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            capabilities {
+              drop = ["ALL"]
+              add  = ["NET_BIND_SERVICE"]
+            }
+          }
+
+          port {
+            name           = "dns-tcp"
+            container_port = 53
+            host_port      = 53
+            protocol       = "TCP"
+          }
+
+          port {
+            name           = "dns-udp"
+            container_port = 53
+            host_port      = 53
+            protocol       = "UDP"
+          }
+
+          port {
+            name           = "metrics"
+            container_port = 9153
+            protocol       = "TCP"
+          }
+
+          volume_mount {
+            name       = "config"
+            mount_path = "/etc/coredns"
+            read_only  = true
+          }
+        }
+
+        volume {
+          name = "config"
+          config_map {
+            name         = kubernetes_config_map.dns.metadata[0].name
+            default_mode = "0644"
+            items {
+              key  = "Corefile"
+              path = "Corefile"
+            }
+            dynamic "items" {
+              for_each = local.db_files
+              content {
+                key  = items.key
+                path = "db.${items.key}"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "dns" {
+  metadata {
+    name      = "dns-ports"
+    namespace = kubernetes_namespace.dns.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      dns = "dns"
+    }
+
+    port {
+      name        = "dns-tcp"
+      protocol    = "TCP"
+      port        = 53
+      target_port = 53
+    }
+
+    port {
+      name        = "dns-udp"
+      protocol    = "UDP"
+      port        = 53
+      target_port = 53
+    }
+
+    type = "LoadBalancer"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}