Add new infra architecture 8

infrastructure/platform/networking/dns/unbound-helm/dev/values.yaml

@@ -33,4 +33,32 @@ probes:
   liveness:
     initialDelaySeconds: 30
     periodSeconds: 60
-    command: "drill @127.0.0.1 -p 53 example.org || echo 'DNS query test'"
+    command: "drill @127.0.0.1 -p 53 example.org || echo 'DNS query test'"
+
+# Custom Unbound forward records for Kubernetes DNS
+config:
+  enabled: true
+  # The mvance/unbound image includes forward-records.conf
+  # We need to add Kubernetes-specific forwarding zones
+  forwardRecords: |
+    # Forward all queries to Cloudflare with DNSSEC (catch-all)
+    forward-zone:
+        name: "."
+        forward-tls-upstream: yes
+        forward-addr: 1.1.1.1@853#cloudflare-dns.com
+        forward-addr: 1.0.0.1@853#cloudflare-dns.com
+
+  # Additional server config to mark cluster.local as insecure (no DNSSEC)
+  # and use stub zones for Kubernetes internal DNS (more reliable than forward)
+  serverConfig: |
+    domain-insecure: "cluster.local."
+    private-domain: "cluster.local."
+    local-zone: "10.in-addr.arpa." nodefault
+
+    stub-zone:
+        name: "cluster.local."
+        stub-addr: 10.96.0.10
+
+    stub-zone:
+        name: "10.in-addr.arpa."
+        stub-addr: 10.96.0.10

infrastructure/platform/networking/dns/unbound-helm/templates/configmap.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.config.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "unbound.fullname" . }}-config
+  namespace: {{ .Values.global.namespace }}
+  labels:
+    {{- include "unbound.labels" . | nindent 4 }}
+data:
+  {{- if .Values.config.forwardRecords }}
+  forward-records.conf: |
+{{ .Values.config.forwardRecords | indent 4 }}
+  {{- end }}
+  {{- if .Values.config.serverConfig }}
+  a-records.conf: |
+{{ .Values.config.serverConfig | indent 4 }}
+  {{- end }}
+  {{- if .Values.config.content }}
+  unbound.conf: |
+{{ .Values.config.content | indent 4 }}
+  {{- end }}
+{{- end }}

infrastructure/platform/networking/dns/unbound-helm/templates/deployment.yaml

@@ -61,18 +61,40 @@ spec:
           {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- with .Values.volumeMounts }}
           volumeMounts:
+            {{- if .Values.config.enabled }}
+            {{- if .Values.config.forwardRecords }}
+            - name: unbound-config
+              mountPath: /opt/unbound/etc/unbound/forward-records.conf
+              subPath: forward-records.conf
+            {{- end }}
+            {{- if .Values.config.serverConfig }}
+            - name: unbound-config
+              mountPath: /opt/unbound/etc/unbound/a-records.conf
+              subPath: a-records.conf
+            {{- end }}
+            {{- if .Values.config.content }}
+            - name: unbound-config
+              mountPath: /opt/unbound/etc/unbound/unbound.conf
+              subPath: unbound.conf
+            {{- end }}
+            {{- end }}
+            {{- with .Values.volumeMounts }}
             {{- toYaml . | nindent 12 }}
-          {{- end }}
+            {{- end }}
           {{- with .Values.env }}
           env:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-      {{- with .Values.volumes }}
       volumes:
+        {{- if .Values.config.enabled }}
+        - name: unbound-config
+          configMap:
+            name: {{ include "unbound.fullname" . }}-config
+        {{- end }}
+        {{- with .Values.volumes }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}