Fix resources isues 5

2026-01-22 11:15:11 +01:00
parent 6505044f24
commit 0183f3ab72
20 changed files with 399 additions and 1193 deletions
--- a/infrastructure/platform/mail/mailu-helm/configs/coredns-unbound-patch.yaml
+++ b/infrastructure/platform/mail/mailu-helm/configs/coredns-unbound-patch.yaml
@@ -1,38 +0,0 @@
-# CoreDNS ConfigMap patch to forward external DNS queries to Unbound for DNSSEC validation
-# This is required for Mailu Admin which requires DNSSEC-validating DNS resolver
-#
-# Apply with: kubectl apply -f coredns-unbound-patch.yaml
-# Then restart CoreDNS: kubectl rollout restart deployment coredns -n kube-system
-#
-# Note: The Unbound service IP (10.104.127.213) may change when the cluster is recreated.
-# The setup script will automatically update this based on the actual Unbound service IP.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-data:
-  Corefile: |
-    .:53 {
-        errors
-        health {
-           lameduck 5s
-        }
-        ready
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-           pods insecure
-           fallthrough in-addr.arpa ip6.arpa
-           ttl 30
-        }
-        prometheus :9153
-        forward . UNBOUND_SERVICE_IP {
-           max_concurrent 1000
-        }
-        cache 30 {
-           disable success cluster.local
-           disable denial cluster.local
-        }
-        loop
-        reload
-        loadbalance
-    }
--- a/infrastructure/platform/mail/mailu-helm/dev/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/dev/values.yaml
@@ -1,34 +1,19 @@
 # Development-tuned Mailu configuration
 global:
-  # Using Unbound DNS for DNSSEC validation (required by Mailu admin)
-  # This value is dynamically set via --set during helm install:
-  #   UNBOUND_IP=$(kubectl get svc unbound-dns -n bakery-ia -o jsonpath='{.spec.clusterIP}')
-  #   helm upgrade --install mailu ... --set global.custom_dns_servers="$UNBOUND_IP"
-  # Default fallback to Kubernetes DNS (will be overridden by --set)
-  custom_dns_servers: "10.96.0.10"  # Override with Unbound IP via --set
+  # Using Kubernetes CoreDNS for DNS resolution
+  # CoreDNS is configured with DNS-over-TLS (Cloudflare) for DNSSEC validation
+  # Default to Kubernetes DNS IP (will be overridden dynamically if needed)
+  custom_dns_servers: "10.96.0.10"  # Kubernetes DNS IP

 # Redis configuration - use built-in Mailu Redis (no authentication needed)
 externalRedis:
  enabled: false

-# Component-specific DNS configuration
-# Admin requires DNSSEC validation - use Unbound DNS (forwards cluster.local to kube-dns)
-# NOTE: dnsConfig.nameservers is dynamically set via --set during helm install
+# DNS configuration - use Kubernetes DNS (ClusterFirst)
+# CoreDNS provides DNSSEC validation via DNS-over-TLS to Cloudflare
 admin:
-  dnsPolicy: "None"
-  dnsConfig:
-    nameservers:
-      - "10.96.0.10"   # Override with Unbound IP via --set admin.dnsConfig.nameservers[0]
-    searches:
-      - "bakery-ia.svc.cluster.local"
-      - "svc.cluster.local"
-      - "cluster.local"
-    options:
-      - name: ndots
-        value: "5"
+  dnsPolicy: "ClusterFirst"

-# RSPAMD needs Unbound for DNSSEC validation (DKIM/SPF/DMARC checks)
-# Using ClusterFirst with search domains + Kubernetes DNS which can forward to Unbound
 rspamd:
  dnsPolicy: "ClusterFirst"

--- a/infrastructure/platform/mail/mailu-helm/prod/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/prod/values.yaml
@@ -1,15 +1,15 @@
 # Production-tuned Mailu configuration
 global:
-  # Using Kubernetes cluster DNS for name resolution
-  custom_dns_servers: "10.96.0.10"  # Kubernetes cluster DNS IP
+  # Using Kubernetes CoreDNS for DNS resolution
+  # CoreDNS is configured with DNS-over-TLS (Cloudflare) for DNSSEC validation
+  custom_dns_servers: "10.152.183.10"  # MicroK8s CoreDNS IP

 # Redis configuration - use built-in Mailu Redis (no authentication needed for internal)
 externalRedis:
  enabled: false

 # DNS configuration for production
-# Use Kubernetes DNS (ClusterFirst) which forwards to Unbound via CoreDNS
-# This is configured automatically by the mailu-helm Tilt resource
+# Use Kubernetes DNS (ClusterFirst) - CoreDNS provides DNSSEC via DNS-over-TLS
 admin:
  dnsPolicy: "ClusterFirst"

--- a/infrastructure/platform/mail/mailu-helm/scripts/deploy-mailu-prod.sh
+++ b/infrastructure/platform/mail/mailu-helm/scripts/deploy-mailu-prod.sh
@@ -4,11 +4,10 @@
 # =============================================================================
 # This script automates the deployment of Mailu mail server for production.
 # It handles:
-#   1. Unbound DNS deployment (for DNSSEC validation)
-#   2. CoreDNS configuration (forward to Unbound)
-#   3. TLS certificate secret creation
-#   4. Admin credentials secret creation
-#   5. Mailu Helm deployment (admin user created automatically via initialAccount)
+#   1. CoreDNS configuration with DNS-over-TLS for DNSSEC validation
+#   2. TLS certificate secret creation
+#   3. Admin credentials secret creation
+#   4. Mailu Helm deployment (admin user created automatically via initialAccount)
 #
 # Usage:
 #   ./deploy-mailu-prod.sh [--domain DOMAIN] [--admin-password PASSWORD]
@@ -99,52 +98,15 @@ fi
 print_success "Prerequisites check passed"

 # =============================================================================
-# Step 1: Deploy Unbound DNS Resolver
+# Step 1: Configure CoreDNS with DNS-over-TLS for DNSSEC
 # =============================================================================
-print_step "Step 1: Deploying Unbound DNS resolver..."
+print_step "Step 1: Configuring CoreDNS with DNS-over-TLS for DNSSEC validation..."

-if kubectl get deployment unbound -n "$NAMESPACE" &>/dev/null; then
-    print_success "Unbound already deployed"
-else
-    helm upgrade --install unbound "$MAILU_HELM_DIR/../../networking/dns/unbound-helm" \
-        -n "$NAMESPACE" \
-        -f "$MAILU_HELM_DIR/../../networking/dns/unbound-helm/values.yaml" \
-        -f "$MAILU_HELM_DIR/../../networking/dns/unbound-helm/prod/values.yaml" \
-        --timeout 5m \
-        --wait
+# Check if CoreDNS is already configured with DNS-over-TLS
+CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' 2>/dev/null | grep -o 'tls://1.1.1.1' || echo "")

-    print_success "Unbound deployed"
-fi
-
-# Wait for Unbound to be ready
-kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=unbound -n "$NAMESPACE" --timeout=120s
-
-# Get Unbound service IP (dynamic resolution)
-echo "Waiting for Unbound service to get assigned IP..."
-for i in {1..30}; do
-    UNBOUND_IP=$(kubectl get svc unbound-dns -n "$NAMESPACE" -o jsonpath='{.spec.clusterIP}' 2>/dev/null || echo "")
-    if [ -n "$UNBOUND_IP" ] && [ "$UNBOUND_IP" != "<none>" ]; then
-        echo "Unbound DNS service IP: $UNBOUND_IP"
-        break
-    fi
-    if [ $i -eq 30 ]; then
-        print_error "Failed to get Unbound service IP"
-        exit 1
-    fi
-    sleep 2
-    echo "Waiting for Unbound service IP... (attempt $i/30)"
-done
-
-# =============================================================================
-# Step 2: Configure CoreDNS to Forward to Unbound
-# =============================================================================
-print_step "Step 2: Configuring CoreDNS for DNSSEC validation..."
-
-# Check current CoreDNS forward configuration
-CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' | grep -o 'forward \. [0-9.]*' | awk '{print $3}' || echo "")
-
-if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
-    echo "Updating CoreDNS to forward to Unbound ($UNBOUND_IP)..."
+if [ -z "$CURRENT_FORWARD" ]; then
+    echo "Updating CoreDNS to use DNS-over-TLS with Cloudflare for DNSSEC validation..."

    # Create a temporary file with the CoreDNS configuration
    TEMP_COREFILE=$(mktemp)
@@ -161,8 +123,9 @@ if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
       ttl 30
    }
    prometheus :9153
-    forward . $UNBOUND_IP {
-       max_concurrent 1000
+    forward . tls://1.1.1.1 tls://1.0.0.1 {
+       tls_servername cloudflare-dns.com
+       health_check 5s
    }
    cache 30 {
       disable success cluster.local
@@ -187,15 +150,19 @@ EOF
    kubectl rollout restart deployment coredns -n kube-system
    kubectl rollout status deployment coredns -n kube-system --timeout=60s

-    print_success "CoreDNS configured to forward to Unbound"
+    print_success "CoreDNS configured with DNS-over-TLS for DNSSEC validation"
 else
-    print_success "CoreDNS already configured for Unbound"
+    print_success "CoreDNS already configured with DNS-over-TLS"
 fi

+# Get CoreDNS service IP for Mailu configuration
+COREDNS_IP=$(kubectl get svc kube-dns -n kube-system -o jsonpath='{.spec.clusterIP}')
+echo "CoreDNS service IP: $COREDNS_IP"
+
 # =============================================================================
-# Step 3: Create TLS Certificate Secret
+# Step 2: Create TLS Certificate Secret
 # =============================================================================
-print_step "Step 3: Creating TLS certificate secret..."
+print_step "Step 2: Creating TLS certificate secret..."

 if kubectl get secret mailu-certificates -n "$NAMESPACE" &>/dev/null; then
    print_success "TLS certificate secret already exists"
@@ -217,9 +184,9 @@ else
 fi

 # =============================================================================
-# Step 4: Create Admin Credentials Secret
+# Step 3: Create Admin Credentials Secret
 # =============================================================================
-print_step "Step 4: Creating admin credentials secret..."
+print_step "Step 3: Creating admin credentials secret..."

 if kubectl get secret mailu-admin-credentials -n "$NAMESPACE" &>/dev/null; then
    print_success "Admin credentials secret already exists"
@@ -243,33 +210,28 @@ else
 fi

 # =============================================================================
-# Step 5: Deploy Mailu via Helm
+# Step 4: Deploy Mailu via Helm
 # =============================================================================
-print_step "Step 5: Deploying Mailu via Helm..."
+print_step "Step 4: Deploying Mailu via Helm..."

 # Add Mailu Helm repository
 helm repo add mailu https://mailu.github.io/helm-charts 2>/dev/null || true
 helm repo update mailu

-# Create temporary values file with dynamic DNS server
-TEMP_VALUES=$(mktemp)
-cat "$MAILU_HELM_DIR/values.yaml" | sed "s/# custom_dns_servers: \"\"  # Will be set dynamically by deployment script/custom_dns_servers: \"$UNBOUND_IP\"/" > "$TEMP_VALUES"
-
-# Deploy Mailu with dynamic DNS configuration
+# Deploy Mailu with CoreDNS configuration
 helm upgrade --install mailu mailu/mailu \
    -n "$NAMESPACE" \
-    -f "$TEMP_VALUES" \
+    -f "$MAILU_HELM_DIR/values.yaml" \
    -f "$MAILU_HELM_DIR/prod/values.yaml" \
+    --set global.custom_dns_servers="$COREDNS_IP" \
    --timeout 10m

-rm -f "$TEMP_VALUES"
-
 print_success "Mailu Helm release deployed (admin user will be created automatically)"

 # =============================================================================
-# Step 6: Wait for Pods to be Ready
+# Step 5: Wait for Pods to be Ready
 # =============================================================================
-print_step "Step 6: Waiting for Mailu pods to be ready..."
+print_step "Step 5: Waiting for Mailu pods to be ready..."

 echo "This may take 5-10 minutes (ClamAV takes time to initialize)..."

@@ -307,6 +269,10 @@ echo "  Webmail:     https://mail.$DOMAIN/webmail"
 echo "  SMTP:        mail.$DOMAIN:587 (STARTTLS)"
 echo "  IMAP:        mail.$DOMAIN:993 (SSL)"
 echo ""
+echo "DNS Configuration:"
+echo "  CoreDNS is configured with DNS-over-TLS (Cloudflare) for DNSSEC validation"
+echo "  CoreDNS IP: $COREDNS_IP"
+echo ""
 echo "Next Steps:"
 echo "  1. Configure DNS records (A, MX, SPF, DMARC)"
 echo "  2. Get DKIM key: kubectl exec -n $NAMESPACE deployment/mailu-admin -- cat /dkim/$DOMAIN.dkim.pub"
--- a/infrastructure/platform/mail/mailu-helm/scripts/deploy-phase7-fixed.sh
+++ b/infrastructure/platform/mail/mailu-helm/scripts/deploy-phase7-fixed.sh
@@ -3,16 +3,13 @@
 # Phase 7: Deploy Optional Services - Fixed Version
 # =============================================================================
 # This script deploys the optional services for production:
-# 1. Unbound DNS (with dynamic IP resolution)
-# 2. CoreDNS configuration for DNSSEC
-# 3. Mailu Email Server
-# 4. SigNoz Monitoring
+# 1. CoreDNS configuration with DNS-over-TLS for DNSSEC validation
+# 2. Mailu Email Server
+# 3. SigNoz Monitoring
 #
-# Fixed issues:
-# - Removed static ClusterIP that caused CIDR range conflicts
-# - Implemented dynamic IP resolution for Unbound DNS
-# - Updated CoreDNS patching to use dynamic IP
-# - Updated Mailu configuration to use dynamic DNS server
+# DNS Architecture:
+# - CoreDNS uses DNS-over-TLS with Cloudflare (1.1.1.1) for DNSSEC validation
+# - Mailu uses CoreDNS for DNS resolution (internal K8s + external DNSSEC)
 # =============================================================================

 set -e
@@ -40,49 +37,15 @@ print_success() {
 }

 # =============================================================================
-# Step 7.1: Deploy Unbound DNS (with dynamic IP)
+# Step 7.1: Configure CoreDNS with DNS-over-TLS for DNSSEC
 # =============================================================================
-print_step "Step 7.1: Deploying Unbound DNS resolver (dynamic IP)..."
+print_step "Step 7.1: Configuring CoreDNS with DNS-over-TLS for DNSSEC validation..."

-if kubectl get deployment unbound -n "$NAMESPACE" &>/dev/null; then
-    print_success "Unbound already deployed"
-else
-    helm upgrade --install unbound infrastructure/platform/networking/dns/unbound-helm \
-        -n "$NAMESPACE" \
-        -f infrastructure/platform/networking/dns/unbound-helm/values.yaml \
-        -f infrastructure/platform/networking/dns/unbound-helm/prod/values.yaml \
-        --timeout 5m \
-        --wait
-    
-    print_success "Unbound deployed"
-fi
+# Check if CoreDNS is already configured with DNS-over-TLS
+CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' 2>/dev/null | grep -o 'tls://1.1.1.1' || echo "")

-# Wait for Unbound service to get assigned IP
-print_step "Waiting for Unbound service to get assigned IP..."
-for i in {1..30}; do
-    UNBOUND_IP=$(kubectl get svc unbound-dns -n "$NAMESPACE" -o jsonpath='{.spec.clusterIP}' 2>/dev/null || echo "")
-    if [ -n "$UNBOUND_IP" ] && [ "$UNBOUND_IP" != "<none>" ]; then
-        echo "Unbound DNS service IP: $UNBOUND_IP"
-        break
-    fi
-    if [ $i -eq 30 ]; then
-        print_error "Failed to get Unbound service IP"
-        exit 1
-    fi
-    sleep 2
-    echo "Waiting for Unbound service IP... (attempt $i/30)"
-done
-
-# =============================================================================
-# Step 7.2: Configure CoreDNS for DNSSEC (dynamic IP)
-# =============================================================================
-print_step "Step 7.2: Configuring CoreDNS for DNSSEC validation..."
-
-# Check current CoreDNS forward configuration
-CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' | grep -o 'forward \. [0-9.]*' | awk '{print $3}' || echo "")
-
-if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
-    echo "Updating CoreDNS to forward to Unbound ($UNBOUND_IP)..."
+if [ -z "$CURRENT_FORWARD" ]; then
+    echo "Updating CoreDNS to use DNS-over-TLS with Cloudflare..."

    # Create a temporary file with the CoreDNS configuration
    TEMP_COREFILE=$(mktemp)
@@ -99,8 +62,9 @@ if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
       ttl 30
    }
    prometheus :9153
-    forward . $UNBOUND_IP {
-       max_concurrent 1000
+    forward . tls://1.1.1.1 tls://1.0.0.1 {
+       tls_servername cloudflare-dns.com
+       health_check 5s
    }
    cache 30 {
       disable success cluster.local
@@ -125,33 +89,32 @@ EOF
    kubectl rollout restart deployment coredns -n kube-system
    kubectl rollout status deployment coredns -n kube-system --timeout=60s

-    print_success "CoreDNS configured to forward to Unbound"
+    print_success "CoreDNS configured with DNS-over-TLS"
 else
-    print_success "CoreDNS already configured for Unbound"
+    print_success "CoreDNS already configured with DNS-over-TLS"
 fi

+# Get CoreDNS service IP
+COREDNS_IP=$(kubectl get svc kube-dns -n kube-system -o jsonpath='{.spec.clusterIP}')
+echo "CoreDNS service IP: $COREDNS_IP"
+
 # =============================================================================
-# Step 7.3: Deploy Mailu Email Server (dynamic DNS)
+# Step 7.2: Deploy Mailu Email Server
 # =============================================================================
-print_step "Step 7.3: Deploying Mailu Email Server..."
+print_step "Step 7.2: Deploying Mailu Email Server..."

 # Add Mailu Helm repository
 helm repo add mailu https://mailu.github.io/helm-charts 2>/dev/null || true
 helm repo update mailu

-# Create temporary values file with dynamic DNS server
-TEMP_VALUES=$(mktemp)
-cat infrastructure/platform/mail/mailu-helm/values.yaml | sed "s/# custom_dns_servers: \"\"  # Will be set dynamically by deployment script/custom_dns_servers: \"$UNBOUND_IP\"/" > "$TEMP_VALUES"
-
-# Deploy Mailu with dynamic DNS configuration
+# Deploy Mailu with CoreDNS configuration
 helm upgrade --install mailu mailu/mailu \
    -n "$NAMESPACE" \
-    -f "$TEMP_VALUES" \
+    -f infrastructure/platform/mail/mailu-helm/values.yaml \
    -f infrastructure/platform/mail/mailu-helm/prod/values.yaml \
+    --set global.custom_dns_servers="$COREDNS_IP" \
    --timeout 10m

-rm -f "$TEMP_VALUES"
-
 print_success "Mailu Helm release deployed"

 # Wait for Mailu pods to be ready
@@ -165,9 +128,9 @@ kubectl wait --for=condition=ready pod -l app.kubernetes.io/component=admin -n "
 print_success "Mailu deployment completed"

 # =============================================================================
-# Step 7.4: Deploy SigNoz Monitoring
+# Step 7.3: Deploy SigNoz Monitoring
 # =============================================================================
-print_step "Step 7.4: Deploying SigNoz Monitoring..."
+print_step "Step 7.3: Deploying SigNoz Monitoring..."

 # Add SigNoz Helm repository
 helm repo add signoz https://charts.signoz.io 2>/dev/null || true
@@ -196,9 +159,8 @@ echo -e "${GREEN}Phase 7 Deployment Complete!${NC}"
 echo "=============================================="
 echo ""
 echo "Deployed Services:"
-echo "  ✓ Unbound DNS (IP: $UNBOUND_IP)"
-echo "  ✓ CoreDNS (configured for DNSSEC)"
-echo "  ✓ Mailu Email Server"
+echo "  ✓ CoreDNS (configured with DNS-over-TLS for DNSSEC)"
+echo "  ✓ Mailu Email Server (using CoreDNS IP: $COREDNS_IP)"
 echo "  ✓ SigNoz Monitoring"
 echo ""
 echo "Next Steps:"
--- a/infrastructure/platform/mail/mailu-helm/values.yaml
+++ b/infrastructure/platform/mail/mailu-helm/values.yaml
@@ -3,8 +3,8 @@

 # Global DNS configuration for DNSSEC validation
 global:
-  # Using Unbound DNS resolver directly for DNSSEC validation
-  # Unbound service is available at unbound-dns.bakery-ia.svc.cluster.local
+  # Using Kubernetes CoreDNS with DNS-over-TLS for DNSSEC validation
+  # CoreDNS is configured to forward external queries to Cloudflare (tls://1.1.1.1)
  # DNS server IP will be dynamically resolved during deployment
  # custom_dns_servers: ""  # Will be set dynamically by deployment script

@@ -230,6 +230,5 @@ networkPolicy:

 # DNS Policy Configuration
 # Use Kubernetes DNS (ClusterFirst) for internal service resolution
-# DNSSEC validation for email is handled by rspamd component
-# Note: For production with DNSSEC needs, configure CoreDNS to forward to Unbound
+# DNSSEC validation is provided by CoreDNS with DNS-over-TLS (Cloudflare)
 dnsPolicy: "ClusterFirst"