Skip to content

Commit b5a5513

Browse files
hanazukihanazuki
authored
Merge pull request #198 from ruby-no-kai/dnsdist
dns-cache: Provide DoQ using dnsdist
2 parents 1e13878 + acd55d2 commit b5a5513

10 files changed

Lines changed: 224 additions & 11 deletions

File tree

‎gen/k8s/dns-cache/configmap.yml‎

Lines changed: 12 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/k8s/dns-cache/deployment.yml‎

Lines changed: 68 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎gen/k8s/dns-cache/monitoring.yml‎

Lines changed: 23 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎k8s/dns-cache/config/dnsdist.lua‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
crt_path = '/secrets/tls-cert/tls.crt'
2+
key_path = '/secrets/tls-cert/tls.key'
3+
4+
newServer(
5+
{
6+
address = '127.0.0.1:10053',
7+
maxInFlight = 1000,
8+
}
9+
)
10+
11+
addTLSLocal(
12+
'0.0.0.0:10853', crt_path, key_path,
13+
{
14+
maxInFlight = 1000,
15+
minTLSVersion = 'tls1.3',
16+
}
17+
)
18+
19+
20+
addDOQLocal(
21+
'0.0.0.0:10853', crt_path, key_path,
22+
{
23+
maxInFlight = 1000,
24+
}
25+
)
26+
27+
webserver(
28+
'0.0.0.0:9823'
29+
)
30+
setWebserverConfig(
31+
{
32+
acl = "127.0.0.1, 10.33.128.0/17",
33+
statsRequireAuthentication = false,
34+
}
35+
)

‎k8s/dns-cache/config/unbound.conf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ server:
99
val-log-level: 2
1010

1111
interface: 0.0.0.0@10053
12-
interface: 0.0.0.0@10853
12+
# interface: 0.0.0.0@10853
1313
interface: 0.0.0.0@10443
1414
port: 10053
15-
tls-port: 10853
15+
# tls-port: 10853
1616
https-port: 10443
1717
access-control: 10.33.0.0/16 allow
1818

@@ -65,13 +65,15 @@ server:
6565
local-data: "resolver.rubykaigi.net. 300 IN HTTPS 1 . alpn=h3,h2"
6666
local-data: "_dns.resolver.rubykaigi.net. 300 IN SVCB 1 resolver.rubykaigi.net. alpn=**,h3,h2 dohpath=/dns-query{?dns}"
6767
local-data: "_dns.resolver.rubykaigi.net. 300 IN SVCB 2 resolver.rubykaigi.net. alpn=dot"
68+
local-data: "_dns.resolver.rubykaigi.net. 300 IN SVCB 3 resolver.rubykaigi.net. alpn=doq"
6869
local-data: "_dns.resolver.rubykaigi.net. 300 IN SVCB 9 resolver.rubykaigi.net. alpn=http/1.1 dohpath=/dns-query{?dns}"
6970

7071
# https://datatracker.ietf.org/doc/rfc9462/
7172
local-zone: resolver.arpa. static
7273
domain-insecure: resolver.arpa.
7374
local-data: "_dns.resolver.arpa. 300 IN SVCB 1 resolver.rubykaigi.net. alpn=**,h3,h2 ipv4hint=192.50.220.164,192.50.220.165 ipv6hint=2001:df0:8500:ca6d:53::c,2001:df0:8500:ca6d:53::d dohpath=/dns-query{?dns}"
7475
local-data: "_dns.resolver.arpa. 300 IN SVCB 2 resolver.rubykaigi.net. alpn=dot ipv4hint=192.50.220.164,192.50.220.165 ipv6hint=2001:df0:8500:ca6d:53::c,2001:df0:8500:ca6d:53::d"
76+
local-data: "_dns.resolver.arpa. 300 IN SVCB 3 resolver.rubykaigi.net. alpn=doq ipv4hint=192.50.220.164,192.50.220.165 ipv6hint=2001:df0:8500:ca6d:53::c,2001:df0:8500:ca6d:53::d"
7577
local-data: "_dns.resolver.arpa. 300 IN SVCB 9 resolver.rubykaigi.net. alpn=http/1.1 ipv4hint=192.50.220.164,192.50.220.165 ipv6hint=2001:df0:8500:ca6d:53::c,2001:df0:8500:ca6d:53::d dohpath=/dns-query{?dns}"
7678

7779
# https://datatracker.ietf.org/doc/rfc9606/

‎k8s/dns-cache/configmap.jsonnet‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@
99
'unbound.conf': importstr './config/unbound.conf',
1010
},
1111
},
12+
{
13+
apiVersion: 'v1',
14+
kind: 'ConfigMap',
15+
metadata: {
16+
name: 'dnsdist-config',
17+
},
18+
data: {
19+
'dnsdist.lua': importstr './config/dnsdist.lua',
20+
},
21+
},
1222
{
1323
apiVersion: 'v1',
1424
kind: 'ConfigMap',

‎k8s/dns-cache/deployment.jsonnet‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,6 @@ local tls_cert_secret = 'cert-resolver-rubykaigi-net';
5353
ports: [
5454
{ name: 'dns', containerPort: 10053, protocol: 'UDP' },
5555
{ name: 'dns-tcp', containerPort: 10053, protocol: 'TCP' },
56-
{ name: 'dns-tls', containerPort: 10853, protocol: 'TCP' },
5756
{ name: 'dns-h2', containerPort: 10443, protocol: 'TCP' },
5857
{ name: 'prom', containerPort: 9167 },
5958
],
@@ -75,6 +74,36 @@ local tls_cert_secret = 'cert-resolver-rubykaigi-net';
7574
periodSeconds: 3,
7675
},
7776
},
77+
{
78+
name: 'dnsdist',
79+
resources: {
80+
requests: {
81+
cpu: '5m',
82+
memory: '32M',
83+
},
84+
},
85+
image: '005216166247.dkr.ecr.ap-northeast-1.amazonaws.com/dnsdist:be372f5f14d6211a6aa46643c4a389fb64455246',
86+
args: ['-C', '/etc/dnsdist/dnsdist.lua', '--supervised', '--disable-syslog', '--verbose'],
87+
ports: [
88+
{ name: 'dns-tls', containerPort: 10853, protocol: 'TCP' },
89+
{ name: 'dns-quic', containerPort: 10853, protocol: 'UDP' },
90+
{ name: 'prom-dnsdist', containerPort: 9823 },
91+
],
92+
env: [
93+
],
94+
volumeMounts: [
95+
{ name: 'dnsdist-config', mountPath: '/etc/dnsdist', readOnly: true },
96+
{ name: 'tls-cert', mountPath: '/secrets/tls-cert', readOnly: true },
97+
],
98+
readinessProbe: {
99+
httpGet: { path: '/jsonstat?command=stats', port: 9823, scheme: 'HTTP' },
100+
},
101+
livenessProbe: {
102+
httpGet: { path: '/jsonstat?command=stats', port: 9823, scheme: 'HTTP' },
103+
failureThreshold: 2,
104+
periodSeconds: 3,
105+
},
106+
},
78107
],
79108
volumes: [
80109
{
@@ -83,6 +112,12 @@ local tls_cert_secret = 'cert-resolver-rubykaigi-net';
83112
name: 'unbound-config',
84113
},
85114
},
115+
{
116+
name: 'dnsdist-config',
117+
configMap: {
118+
name: 'dnsdist-config',
119+
},
120+
},
86121
{
87122
name: 'tls-cert',
88123
secret: {

‎k8s/dns-cache/monitoring.jsonnet‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,29 @@ local dnsProbes(domain) = [
7474
},
7575
},
7676

77+
{
78+
apiVersion: 'monitoring.coreos.com/v1',
79+
kind: 'PodMonitor',
80+
metadata: {
81+
name: 'dnsdist',
82+
labels: {
83+
release: 'kube-prometheus-stack',
84+
},
85+
},
86+
spec: {
87+
selector: {
88+
matchLabels: {
89+
'rubykaigi.org/app': 'unbound',
90+
},
91+
},
92+
podMetricsEndpoints: [
93+
{
94+
port: 'prom-dnsdist',
95+
},
96+
],
97+
},
98+
},
99+
77100
{
78101
apiVersion: 'monitoring.coreos.com/v1',
79102
kind: 'PodMonitor',

‎tf/dns-cache/elb.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,11 @@ resource "kubernetes_manifest" "targetgroupbinding-dns-cache-dns" {
7373

7474
###
7575

76+
# dot & doq
7677
resource "aws_lb_listener" "dns-tls" {
7778
load_balancer_arn = aws_lb.nlb.arn
7879
port = "853"
79-
protocol = "TCP"
80+
protocol = "TCP_UDP"
8081

8182
default_action {
8283
type = "forward"
@@ -88,7 +89,7 @@ resource "aws_lb_target_group" "dns-tls" {
8889
name = "dns-cache-dns-${substr(uuid(), 0, 10)}"
8990
target_type = "ip"
9091
port = local.dns_cache_dns_tls_target_port
91-
protocol = "TCP"
92+
protocol = "TCP_UDP"
9293
vpc_id = data.aws_vpc.main.id
9394

9495
connection_termination = true

‎tf/dns-cache/sg.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ resource "aws_security_group_rule" "k8s-node_dns-cache-tls" {
2828
cidr_blocks = ["10.33.0.0/16"]
2929
}
3030

31+
resource "aws_security_group_rule" "k8s-node_dns-cache-quic" {
32+
security_group_id = data.terraform_remote_state.k8s.outputs.node_security_group
33+
description = "dns-cache-dns-tcp"
34+
type = "ingress"
35+
from_port = local.dns_cache_dns_tls_target_port
36+
to_port = local.dns_cache_dns_tls_target_port
37+
protocol = "udp"
38+
cidr_blocks = ["10.33.0.0/16"]
39+
}
40+
3141
resource "aws_security_group_rule" "k8s-node_dns-cache-https" {
3242
security_group_id = data.terraform_remote_state.k8s.outputs.node_security_group
3343
description = "dns-cache-dns-https"

0 commit comments

Comments
 (0)