Fix resources isues 5

infrastructure/platform/mail/mailu-helm/scripts/deploy-phase7-fixed.sh

@@ -3,16 +3,13 @@
 # Phase 7: Deploy Optional Services - Fixed Version
 # =============================================================================
 # This script deploys the optional services for production:
-# 1. Unbound DNS (with dynamic IP resolution)
-# 2. CoreDNS configuration for DNSSEC
-# 3. Mailu Email Server
-# 4. SigNoz Monitoring
+# 1. CoreDNS configuration with DNS-over-TLS for DNSSEC validation
+# 2. Mailu Email Server
+# 3. SigNoz Monitoring
 #
-# Fixed issues:
-# - Removed static ClusterIP that caused CIDR range conflicts
-# - Implemented dynamic IP resolution for Unbound DNS
-# - Updated CoreDNS patching to use dynamic IP
-# - Updated Mailu configuration to use dynamic DNS server
+# DNS Architecture:
+# - CoreDNS uses DNS-over-TLS with Cloudflare (1.1.1.1) for DNSSEC validation
+# - Mailu uses CoreDNS for DNS resolution (internal K8s + external DNSSEC)
 # =============================================================================
 
 set -e
@@ -40,49 +37,15 @@ print_success() {
 }
 
 # =============================================================================
-# Step 7.1: Deploy Unbound DNS (with dynamic IP)
+# Step 7.1: Configure CoreDNS with DNS-over-TLS for DNSSEC
 # =============================================================================
-print_step "Step 7.1: Deploying Unbound DNS resolver (dynamic IP)..."
+print_step "Step 7.1: Configuring CoreDNS with DNS-over-TLS for DNSSEC validation..."
 
-if kubectl get deployment unbound -n "$NAMESPACE" &>/dev/null; then
-    print_success "Unbound already deployed"
-else
-    helm upgrade --install unbound infrastructure/platform/networking/dns/unbound-helm \
-        -n "$NAMESPACE" \
-        -f infrastructure/platform/networking/dns/unbound-helm/values.yaml \
-        -f infrastructure/platform/networking/dns/unbound-helm/prod/values.yaml \
-        --timeout 5m \
-        --wait
-    
-    print_success "Unbound deployed"
-fi
+# Check if CoreDNS is already configured with DNS-over-TLS
+CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' 2>/dev/null | grep -o 'tls://1.1.1.1' || echo "")
 
-# Wait for Unbound service to get assigned IP
-print_step "Waiting for Unbound service to get assigned IP..."
-for i in {1..30}; do
-    UNBOUND_IP=$(kubectl get svc unbound-dns -n "$NAMESPACE" -o jsonpath='{.spec.clusterIP}' 2>/dev/null || echo "")
-    if [ -n "$UNBOUND_IP" ] && [ "$UNBOUND_IP" != "<none>" ]; then
-        echo "Unbound DNS service IP: $UNBOUND_IP"
-        break
-    fi
-    if [ $i -eq 30 ]; then
-        print_error "Failed to get Unbound service IP"
-        exit 1
-    fi
-    sleep 2
-    echo "Waiting for Unbound service IP... (attempt $i/30)"
-done
-
-# =============================================================================
-# Step 7.2: Configure CoreDNS for DNSSEC (dynamic IP)
-# =============================================================================
-print_step "Step 7.2: Configuring CoreDNS for DNSSEC validation..."
-
-# Check current CoreDNS forward configuration
-CURRENT_FORWARD=$(kubectl get configmap coredns -n kube-system -o jsonpath='{.data.Corefile}' | grep -o 'forward \. [0-9.]*' | awk '{print $3}' || echo "")
-
-if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
-    echo "Updating CoreDNS to forward to Unbound ($UNBOUND_IP)..."
+if [ -z "$CURRENT_FORWARD" ]; then
+    echo "Updating CoreDNS to use DNS-over-TLS with Cloudflare..."
 
     # Create a temporary file with the CoreDNS configuration
     TEMP_COREFILE=$(mktemp)
@@ -99,8 +62,9 @@ if [ "$CURRENT_FORWARD" != "$UNBOUND_IP" ]; then
        ttl 30
     }
     prometheus :9153
-    forward . $UNBOUND_IP {
-       max_concurrent 1000
+    forward . tls://1.1.1.1 tls://1.0.0.1 {
+       tls_servername cloudflare-dns.com
+       health_check 5s
     }
     cache 30 {
        disable success cluster.local
@@ -125,33 +89,32 @@ EOF
     kubectl rollout restart deployment coredns -n kube-system
     kubectl rollout status deployment coredns -n kube-system --timeout=60s
 
-    print_success "CoreDNS configured to forward to Unbound"
+    print_success "CoreDNS configured with DNS-over-TLS"
 else
-    print_success "CoreDNS already configured for Unbound"
+    print_success "CoreDNS already configured with DNS-over-TLS"
 fi
 
+# Get CoreDNS service IP
+COREDNS_IP=$(kubectl get svc kube-dns -n kube-system -o jsonpath='{.spec.clusterIP}')
+echo "CoreDNS service IP: $COREDNS_IP"
+
 # =============================================================================
-# Step 7.3: Deploy Mailu Email Server (dynamic DNS)
+# Step 7.2: Deploy Mailu Email Server
 # =============================================================================
-print_step "Step 7.3: Deploying Mailu Email Server..."
+print_step "Step 7.2: Deploying Mailu Email Server..."
 
 # Add Mailu Helm repository
 helm repo add mailu https://mailu.github.io/helm-charts 2>/dev/null || true
 helm repo update mailu
 
-# Create temporary values file with dynamic DNS server
-TEMP_VALUES=$(mktemp)
-cat infrastructure/platform/mail/mailu-helm/values.yaml | sed "s/# custom_dns_servers: \"\"  # Will be set dynamically by deployment script/custom_dns_servers: \"$UNBOUND_IP\"/" > "$TEMP_VALUES"
-
-# Deploy Mailu with dynamic DNS configuration
+# Deploy Mailu with CoreDNS configuration
 helm upgrade --install mailu mailu/mailu \
     -n "$NAMESPACE" \
-    -f "$TEMP_VALUES" \
+    -f infrastructure/platform/mail/mailu-helm/values.yaml \
     -f infrastructure/platform/mail/mailu-helm/prod/values.yaml \
+    --set global.custom_dns_servers="$COREDNS_IP" \
     --timeout 10m
 
-rm -f "$TEMP_VALUES"
-
 print_success "Mailu Helm release deployed"
 
 # Wait for Mailu pods to be ready
@@ -165,9 +128,9 @@ kubectl wait --for=condition=ready pod -l app.kubernetes.io/component=admin -n "
 print_success "Mailu deployment completed"
 
 # =============================================================================
-# Step 7.4: Deploy SigNoz Monitoring
+# Step 7.3: Deploy SigNoz Monitoring
 # =============================================================================
-print_step "Step 7.4: Deploying SigNoz Monitoring..."
+print_step "Step 7.3: Deploying SigNoz Monitoring..."
 
 # Add SigNoz Helm repository
 helm repo add signoz https://charts.signoz.io 2>/dev/null || true
@@ -196,9 +159,8 @@ echo -e "${GREEN}Phase 7 Deployment Complete!${NC}"
 echo "=============================================="
 echo ""
 echo "Deployed Services:"
-echo "  ✓ Unbound DNS (IP: $UNBOUND_IP)"
-echo "  ✓ CoreDNS (configured for DNSSEC)"
-echo "  ✓ Mailu Email Server"
+echo "  ✓ CoreDNS (configured with DNS-over-TLS for DNSSEC)"
+echo "  ✓ Mailu Email Server (using CoreDNS IP: $COREDNS_IP)"
 echo "  ✓ SigNoz Monitoring"
 echo ""
 echo "Next Steps:"