Add packer build, terraform configs, instructions

.gitignore

@@ -0,0 +1,5 @@
+dns.env
+.terraform
+terraform.tfstate*
+terraform.tfvars
+

README.md

@@ -0,0 +1,69 @@
+# bind-dns
+
+Use packer and terraform to deploy a pair of Bind DNS servers in an AWS VPC to resolve DNS name for K8s API server (or whatever you wish).
+
+## Usage
+
+1. Clone this repo.
+```
+    $ git clone [email protected]:lander2k2/bind-dns.git
+    $ cd kube-cluster
+```
+
+2. Export your AWS keys and preferred region.
+```
+	$ export AWS_ACCESS_KEY_ID="accesskey"
+	$ export AWS_SECRET_ACCESS_KEY="secretkey"
+	$ export AWS_DEFAULT_REGION="us-east-2"
+```
+
+3. Build a CentOS-based image for your DNS servers.  Not the AMI ID for adding to the tfvars.
+```
+    $ cd images
+    $ packer build ns_template_centos.json
+```
+
+4. Edit terraform variables.  Add the appropriate values for your environment.
+```
+    $ cd ../
+    $ cp terraform.tfvars.example terraform.tfvars
+    $ vi terraform.tfvars
+```
+
+5. Deploy the name servers.  The 2 deployed servers will be identical.  Arbitrarily assign one as the master and the other as the slave.
+```
+    $ terraform init infra
+    $ terraform plan infra
+    $ terraform apply infra
+```
+
+6. Set the variables to configure your name servers.
+```
+    $ cp dns.env.example dns.env
+    $ vi dns.env
+```
+
+7. Copy the env vars to your name servers.
+```
+    $ scp dns.env centos@[master ip]
+    $ scp dns.env centos@[slave ip]
+```
+
+8. Connect to the master name server and configure.
+```
+    $ ssh centos@[master ip]
+    $ sudo su
+    # source dns.env
+    # configure_master.sh
+```
+
+9. Repeat for the slave name server.
+```
+    $ ssh centos@[slave ip]
+    $ sudo su
+    # source dns.env
+    # configure_slave.sh
+```
+
+10. Add the two name server IPs to your jump box resolv.conf
+

dns.env.example

@@ -0,0 +1,19 @@
+# e.g. example.com
+export DOMAIN_NAME=""
+
+# private IP for master DNS server
+export MASTER_IP=""
+
+# private IP for slave DNS server
+export SLAVE_IP=""
+
+# subdomain you will use for k8s API
+export SUBDOMAIN=""
+
+# DNS name for K8s API load balancer
+export API_ELB=""
+
+# IP of jump box from which DNS queries will be sent
+# will also accept a CIDR if preferred
+export JUMP_IP=""
+

images/config_master.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+
+set -e
+
+: "${DOMAIN_NAME:?Env variable DOMAIN_NAME must be set and not empty}"
+: "${SLAVE_IP:?Env variable SLAVE_IP must be set and not empty}"
+: "${SUBDOMAIN:?Env variable SUBDOMAIN must be set and not empty}"
+: "${API_ELB:?Env variable API_ELB must be set and not empty}"
+: "${JUMP_IP:?Env variable JUMP_IP must be set and not empty}"
+: "${FORWARDER:?Env variable FORWARDER must be set and not empty}"
+
+PRIVATE_IP=$(ip addr show eth0 | grep -Po 'inet \K[\d.]+')
+
+grep -qF "${PRIVATE_IP} ns1.${DOMAIN_NAME} ns1" /etc/hosts || echo "${PRIVATE_IP} ns1.${DOMAIN_NAME} ns1" >> /etc/hosts
+
+echo "ns1" > /etc/hostname
+hostname -F /etc/hostname
+
+cat > /etc/named.conf <<EOF
+//
+// named.conf
+//
+// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
+// server as a caching only nameserver (as a localhost DNS resolver only).
+//
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// See the BIND Administrator's Reference Manual (ARM) for details about the
+// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
+
+acl "trusted" {
+	${PRIVATE_IP};
+	${SLAVE_IP};
+	${JUMP_IP};
+};
+
+options {
+	listen-on port 53 { 127.0.0.1; ${PRIVATE_IP}; };
+	listen-on-v6 port 53 { ::1; };
+	directory 	"/var/named";
+	dump-file 	"/var/named/data/cache_dump.db";
+	statistics-file "/var/named/data/named_stats.txt";
+	memstatistics-file "/var/named/data/named_mem_stats.txt";
+	allow-query     { trusted; };
+
+	/*
+	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.  - If you are building a RECURSIVE (caching) DNS server, you need to enable recursion.
+	 - If your recursive DNS server has a public IP address, you MUST enable access
+	   control to limit queries to your legitimate users. Failing to do so will
+	   cause your server to become part of large scale DNS amplification
+	   attacks. Implementing BCP38 within your network would greatly
+	   reduce such attack surface
+	*/
+	recursion yes;
+	allow-transfer { ${SLAVE_IP}; };
+
+    forwarders { ${FORWARDER}; };
+
+	dnssec-enable no;
+	dnssec-validation no;
+
+	/* Path to ISC DLV key */
+	bindkeys-file "/etc/named.iscdlv.key";
+
+	managed-keys-directory "/var/named/dynamic";
+
+	pid-file "/run/named/named.pid";
+	session-keyfile "/run/named/session.key";
+};
+
+logging {
+        channel default_debug {
+                file "data/named.run";
+                severity dynamic;
+        };
+};
+
+zone "." IN {
+	type hint;
+	file "named.ca";
+};
+
+include "/etc/named.rfc1912.zones";
+include "/etc/named.root.key";
+include "/etc/named/named.conf.local";
+EOF
+
+cat > /etc/named/named.conf.local <<EOF
+zone "${DOMAIN_NAME}" {
+	type master;
+	file "/etc/named/zones/db.${DOMAIN_NAME}";
+	allow-transfer { ${SLAVE_IP}; };
+};
+EOF
+
+if [ ! -d /etc/named/zones ]; then
+	mkdir /etc/named/zones
+fi
+cat > /etc/named/zones/db.${DOMAIN_NAME} <<EOF
+;
+; BIND data file for local loopback interface
+;
+\$TTL	604800
+@	IN	SOA	ns1.${DOMAIN_NAME}. admin.${DOMAIN_NAME}. (
+			      5		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+; Name servers
+${DOMAIN_NAME}.	IN	NS	ns1.${DOMAIN_NAME}.
+${DOMAIN_NAME}.	IN	NS	ns2.${DOMAIN_NAME}.
+; A records for name servers
+ns1	IN	A	${PRIVATE_IP}
+ns2	IN	A	${SLAVE_IP}
+;
+${SUBDOMAIN}	IN	CNAME	${API_ELB}.
+EOF
+
+named-checkconf
+
+named-checkzone ${DOMAIN_NAME} /etc/named/zones/db.${DOMAIN_NAME}
+
+systemctl restart named
+systemctl enable named
+
+exit 0
+

images/config_slave.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+
+set -e
+
+: "${DOMAIN_NAME:?Env variable DOMAIN_NAME must be set and not empty}"
+: "${MASTER_IP:?Env variable MASTER_IP must be set and not empty}"
+: "${SUBDOMAIN:?Env variable SUBDOMAIN must be set and not empty}"
+: "${API_ELB:?Env variable API_ELB must be set and not empty}"
+: "${JUMP_IP:?Env variable JUMP_IP must be set and not empty}"
+: "${FORWARDER:?Env variable FORWARDER must be set and not empty}"
+
+PRIVATE_IP=$(ip addr show eth0 | grep -Po 'inet \K[\d.]+')
+
+grep -qF "${PRIVATE_IP} ns2.${DOMAIN_NAME} ns2" /etc/hosts || echo "${PRIVATE_IP} ns2.${DOMAIN_NAME} ns2" >> /etc/hosts
+
+echo "ns2" > /etc/hostname
+hostname -F /etc/hostname
+
+cat > /etc/named.conf <<EOF
+//
+// named.conf
+//
+// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
+// server as a caching only nameserver (as a localhost DNS resolver only).
+//
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+// See the BIND Administrator's Reference Manual (ARM) for details about the
+// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html
+
+acl "trusted" {
+	${PRIVATE_IP};
+	${MASTER_IP};
+	${JUMP_IP};
+};
+
+options {
+	listen-on port 53 { 127.0.0.1; ${PRIVATE_IP}; };
+	listen-on-v6 port 53 { ::1; };
+	directory 	"/var/named";
+	dump-file 	"/var/named/data/cache_dump.db";
+	statistics-file "/var/named/data/named_stats.txt";
+	memstatistics-file "/var/named/data/named_mem_stats.txt";
+	allow-query     { trusted; };
+
+	/*
+	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
+	 - If you are building a RECURSIVE (caching) DNS server, you need to enable
+	   recursion.
+	 - If your recursive DNS server has a public IP address, you MUST enable access
+	   control to limit queries to your legitimate users. Failing to do so will
+	   cause your server to become part of large scale DNS amplification
+	   attacks. Implementing BCP38 within your network would greatly
+	   reduce such attack surface
+	*/
+	recursion yes;
+	allow-transfer { none; };
+
+    forwarders { ${FORWARDER}; };
+
+	dnssec-enable no;
+	dnssec-validation no;
+
+	/* Path to ISC DLV key */
+	bindkeys-file "/etc/named.iscdlv.key";
+
+	managed-keys-directory "/var/named/dynamic";
+
+	pid-file "/run/named/named.pid";
+	session-keyfile "/run/named/session.key";
+};
+
+logging {
+        channel default_debug {
+                file "data/named.run";
+                severity dynamic;
+        };
+};
+
+zone "." IN {
+	type hint;
+	file "named.ca";
+};
+
+include "/etc/named.rfc1912.zones";
+include "/etc/named.root.key";
+include "/etc/named/named.conf.local";
+EOF
+
+cat > /etc/named/named.conf.local <<EOF
+zone "${DOMAIN_NAME}" {
+	type slave;
+	file "/etc/named/zones/db.${DOMAIN_NAME}";
+	masters { ${MASTER_IP}; };
+};
+EOF
+
+if [ ! -d /etc/named/zones ]; then
+	mkdir /etc/named/zones
+fi
+
+named-checkconf
+
+systemctl restart named
+systemctl enable named
+
+exit 0
+

images/install_bind_centos.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+sudo yum clean all
+sudo yum update -y
+sudo yum clean all
+sudo sudo yum install -y bind bindutils
+

images/install_bind_ubuntu.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+sudo apt-get update
+sudo apt-get -y upgrade
+sudo apt-get install -y bind9 bind9utils bind9-doc
+

images/move_files.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sudo chmod +x /tmp/*.sh
+sudo mv /tmp/*.sh /usr/bin/
+

images/ns_template_centos.json

@@ -0,0 +1,36 @@
+{
+    "variables": {
+        "source_ami_id": "ami-e1496384",
+        "aws_region": "us-east-2"
+    },
+    "builders": [
+        {
+            "type": "amazon-ebs",
+            "ami_name": "heptio-dns-centos-{{timestamp}}",
+            "instance_type": "t2.micro",
+            "source_ami": "{{user `source_ami_id`}}",
+            "ssh_username": "centos"
+        }
+    ],
+    "provisioners": [
+        {
+            "type": "file",
+            "source": "config_master.sh",
+            "destination": "/tmp/config_master.sh"
+        },
+        {
+            "type": "file",
+            "source": "config_slave.sh",
+            "destination": "/tmp/config_slave.sh"
+        },
+        {
+            "type": "shell",
+            "script": "install_bind_centos.sh"
+        },
+        {
+            "type": "shell",
+            "script": "./move_files.sh"
+        }
+    ]
+}
+