mats
32f940b763
build / build-push (push) Successful in 29s
Local zones were only editable as mounted files, so operators could not manage DNS entries from the console. Add a Local zones editor backed by a shared Kubernetes ConfigMap, validate master files before saving, scope the pod service account to that ConfigMap, and reload changed zones on every replica while flushing stale cache entries.
37 lines
885 B
YAML
37 lines
885 B
YAML
# The UI edits the shared `fancy-dns-zones` ConfigMap. Its projected volume is
|
|
# read-only; these narrowly scoped permissions let the API update only that
|
|
# one ConfigMap so both DNS replicas receive the same records.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: fancy-dns
|
|
namespace: dns
|
|
labels:
|
|
app.kubernetes.io/name: fancy-dns
|
|
automountServiceAccountToken: true
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: fancy-dns-zones
|
|
namespace: dns
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
resourceNames: ["fancy-dns-zones"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: fancy-dns-zones
|
|
namespace: dns
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: fancy-dns
|
|
namespace: dns
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: fancy-dns-zones
|