fix(k8sgw): forward for all owned domains

kube/clusters/biohazard/config/vars.sops.env

@@ -54,6 +54,7 @@ DNS_STREAM=ENC[AES256_GCM,data:IQKPb0HvNNCjH66+H56oybM4,iv:YcV2u1p3hLIcNGG/G3POu
 DNS_ME=ENC[AES256_GCM,data:mvkrtneuOQ==,iv:tXwnnd4pILQJZcu8S2U6iX4Tu34y7AVKdje98tBGzhc=,tag:VD0Ov9KL8j2RGBTGU0MFAg==,type:str]
 DNS_HOME=ENC[AES256_GCM,data://qMySXhwLc=,iv:FZ3g2rmlpTxRDxZp2K551Ar+m5XMExobObaM6uf9prw=,tag:/cY6U53sjCbaVwlE7A9A1g==,type:str]
 DNS_INTERNAL=ENC[AES256_GCM,data:IjMxQ4Ev7yk=,iv:nFKR0p8T1099khSAOWQBdfGU660n3vMSfhyET3mOdkY=,tag:G4nNPjJym7uT5E2A0y+l7Q==,type:str]
+DNS_FUNNY=ENC[AES256_GCM,data:XGYFv5xnZ6M=,iv:teiYncvQ44vTK+cYiJTSHSYQFv0JxXRs6qM+M9I/KXI=,tag:hykJg2uGKrX0VXxNeHuUXQ==,type:str]
 DNS_KAH=ENC[AES256_GCM,data:MUJI1U6bNmvzvAU=,iv:1eTSLdbbuMwx1YVo0STg8wL9lKy3OaR9KLMznw9LZFs=,tag:BYnkE2X/jKM5Fr/9/6GbfQ==,type:str]
 DNS_NAS=ENC[AES256_GCM,data:tXgzzi0q8Q/4GSL8oPpw3JzgobLF+Zhl/A==,iv:Qr+PpJwgzvSjo4dUA5lnszfwIkdnyT/Y+O7WP8vppls=,tag:eeht1Fj20CJHIWA4o2YW/g==,type:str]
 DNS_OLD_DOCKER=ENC[AES256_GCM,data:9nDHAHXCge/1+Ht8ufHWbqCoCC61,iv:8OsS2kwc+wM91JP2UGAOk9pIV1NMbJftivNRHpS7GMo=,tag:ahE6gj74E60iszNOGrqSzQ==,type:str]
@@ -189,12 +190,12 @@ CONFIG_OVENMEDIAENGINE_NAME=ENC[AES256_GCM,data:58CuH8bcUHWXBZA=,iv:BN7x6aAJPbzI
 CONFIG_THELOUNGE_USERNAME=ENC[AES256_GCM,data:+C2aABtqq8YG,iv:4DYpguAvmaqPedRgrflDlKfX5jJEhyWXKuRS+UVgHLo=,tag:vfJko+R2D8ct7KZC2Vnujw==,type:str]
 CONFIG_THELOUNGE_JOIN=ENC[AES256_GCM,data:ocuC,iv:9Cn9zp2+iIVrEXYxklEtkpftmJwTGsWnff2xIG9KNec=,tag:3UL9Gn+kHoXu+40CFkP7sg==,type:str]
 CONFIG_PSONO_TITLE=ENC[AES256_GCM,data:ORXmkTqtuka3l5M0pdu1NKxdX3Pes3xdEMw=,iv:Mbw/KUQJcIdYdcWby6qeCY4Q31Vc+dUOjLLprHL5P9E=,tag:HavoGugubPrunCoOkL40Mw==,type:str]
-sops_unencrypted_suffix=_unencrypted
-sops_age__list_0__map_recipient=age1u57l4s400gqstc0p485j4646cemntufr0pcyp32yudklsp90xpmszxvnkj
-sops_pgp__list_0__map_created_at=2023-06-01T18:01:04Z
-sops_pgp__list_0__map_fp=31E70E5BC80C58AFF5DD649921AC5A1AC6E5B7F2
-sops_lastmodified=2023-11-27T07:34:03Z
-sops_version=3.7.3
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhF4DAAAAAAAAAAASAQdAbA35718t0WVKrjQFYUPviCb0lVuh8NpfSdJCHjHcWWww\n8ak4q4VL69tZLSjQHx+VsMmKooknxWz6pw0lGxyDYlZMQ81bodInjaZGFZSz8Uuh\n0l4BhDCNDBBALTrnTliz6/DAHvmavI4UxMHost5alFio9JPkTDNmXZyvcy1/R6aw\n/uhQXLUBRvm0TSOhBZb7d0SLkLfe02Um40w1TibpKXsZz1GOMbPRNBMHHra0QIuQ\n=0jA+\n-----END PGP MESSAGE-----\n
-sops_mac=ENC[AES256_GCM,data:ygBi8sAig/BMiZ9cltdINFCUAEhxONcVjt7edw+tskjjeTXP1OJ1uxEqDPwIUt3c7xwjyRAgBLJcxTwARdav2cGKCZAdRBTbCL5plDHyzLNcCigm29l/ZgINx5IDX1Mx5i1oLFfx5683G8zJHMfgZzsVooqvZCWXYNU9EHwX2QY=,iv:sT4QZC6vCUI6ESncEBsA6bkgPW3NSY20ZRKRSzM/rAQ=,tag:87lBaKIto/wGmTBGfNX33g==,type:str]
 sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFSXFvLzFQaFJ0OVJKUFV5\nTWh2OUltUlpJWFlVVytFYU9VajBHSnQ4SGdjCnRVbEVXdDVyUHJrR05Ba0xvUm1l\nTkt2YmNUZy90ZFA2b3QrODFKZ01EVG8KLS0tIEw2dkd1cnFCbnI5eWxKL2o1aDVB\nN0hveXZ2dWdxQ2k2L0pGR0ROMStVTmsK4dV/hNyDjsYnVUiFQ7kqdmcVHfYyVckz\nh/rwLjcZgsup72WDVP3v6Eul8B3LKFrSb8CDFA54tyQmSdFDCQC+Zg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1u57l4s400gqstc0p485j4646cemntufr0pcyp32yudklsp90xpmszxvnkj
+sops_lastmodified=2023-12-11T19:00:52Z
+sops_mac=ENC[AES256_GCM,data:LJ8vG4tuvjneyZuIDr+G2lhoaxWx/tWFv56SwCNuGaR8Fz4u13QGNYFGXC+oF6kcNk2jka/hxCKDD45dbpZ028PPaeKMzl/QAjh1NtQBBK69QMkBLCQB7cQST9CBJwqXe5iZtTuFn8QL8MfP9dZXIZA9I+iXs7n9dMx5VmKKYgA=,iv:AcOPrydJyni3QeZvPKBneszdnfpDqUJ6ZwI6Jvs6RP4=,tag:WZ2X6Z1AxXfiFZBOc5m0EA==,type:str]
+sops_pgp__list_0__map_created_at=2023-06-01T18:01:04Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhF4DAAAAAAAAAAASAQdAbA35718t0WVKrjQFYUPviCb0lVuh8NpfSdJCHjHcWWww\n8ak4q4VL69tZLSjQHx+VsMmKooknxWz6pw0lGxyDYlZMQ81bodInjaZGFZSz8Uuh\n0l4BhDCNDBBALTrnTliz6/DAHvmavI4UxMHost5alFio9JPkTDNmXZyvcy1/R6aw\n/uhQXLUBRvm0TSOhBZb7d0SLkLfe02Um40w1TibpKXsZz1GOMbPRNBMHHra0QIuQ\n=0jA+\n-----END PGP MESSAGE-----\n
+sops_pgp__list_0__map_fp=31E70E5BC80C58AFF5DD649921AC5A1AC6E5B7F2
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1

kube/deploy/core/dns/internal/k8s-gateway/app/hr.yaml

@@ -15,14 +15,13 @@ spec:
         namespace: flux-system
   values:
     fullnameOverride: k8s-gateway
-    domain: "${DNS_SHORT} ${DNS_MAIN} ${DNS_VPN} ${DNS_STREAM}"
+    domain: "${DNS_SHORT} ${DNS_MAIN} ${DNS_VPN} ${DNS_STREAM} ${DNS_ME} ${DNS_HOME} ${DNS_INTERNAL} ${DNS_FUNNY}"
     fallthrough:
       enabled: true
     ttl: 1
     service:
       type: LoadBalancer
       port: 53
-      externalTrafficPolicy: Cluster # Cilium DSR
       annotations:
         "io.cilium/lb-ipam-ips": "${APP_IP_K8S_GATEWAY}"
     extraZonePlugins:
@@ -36,14 +35,26 @@ spec:
       # Serves a /metrics endpoint on :9153, required for serviceMonitor
       - name: prometheus
         parameters: 0.0.0.0:9153
+      - &forward
+        name: forward
+        parameters: "${DNS_SHORT} ${UPSTREAM}"
+        configBlock: "policy sequential"
+      - <<: *forward
+        parameters: "${DNS_MAIN} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_VPN} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_STREAM} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_ME} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_HOME} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_INTERNAL} ${UPSTREAM}"
+      - <<: *forward
+        parameters: "${DNS_FUNNY} ${UPSTREAM}"
       - name: forward
-        parameters: ${DNS_SHORT} ${IP_ROUTER_VLAN_K8S} 1.0.0.1 1.0.0.2 1.0.0.3 1.1.1.1 1.1.1.2 1.1.1.3
-        configBlock: policy sequential
-      - name: forward
-        parameters: ${DNS_MAIN} ${IP_ROUTER_VLAN_K8S} 1.0.0.1 1.0.0.2 1.0.0.3 1.1.1.1 1.1.1.2 1.1.1.3
-        configBlock: policy sequential
-      - name: forward
-        parameters: . /etc/resolv.conf
+        parameters: ". /etc/resolv.conf"
       - name: loop
       - name: reload
       - name: loadbalance

kube/deploy/core/dns/internal/k8s-gateway/ks.yaml

@@ -6,4 +6,7 @@ metadata:
   namespace: flux-system
 spec:
   path: ./kube/deploy/core/dns/internal/k8s-gateway/app
-  dependsOn: []
+  dependsOn: []
+  postBuild:
+    substitute:
+      UPSTREAM: "${IP_ROUTER_VLAN_K8S} 1.0.0.1 1.0.0.2 1.0.0.3 1.1.1.1 1.1.1.2 1.1.1.3"