Skip to content

Commit 0ef6100

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
feat: add FlatRacoon manifest, K8s deployment for NAT64/DNS64
Add ipv6-site-enforcer.manifest.ncl for orchestrator module discovery. Create K8s manifests: Jool NAT64 + Unbound DNS64 sidecar deployment, ClusterIP service (DNS 53 + health 8080), ConfigMap with NAT64 prefix 64:ff9b::/96, and NetworkPolicy restricting traffic. Update justfile with deploy/undeploy/status recipes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 41b465e commit 0ef6100

7 files changed

Lines changed: 267 additions & 11 deletions

File tree

‎ipv6-site-enforcer.manifest.ncl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# ipv6-site-enforcer module manifest for FlatRacoon orchestrator
3+
4+
{
5+
name = "ipv6-site-enforcer",
6+
version = "0.1.0",
7+
layer = 'network,
8+
description = "IPv6 site enforcement with Jool NAT64 translation and Unbound DNS64 synthesis",
9+
repo = "github.com/hyperpolymath/ipv6-site-enforcer",
10+
requires = ["kubernetes"],
11+
provides = ["nat64", "dns64", "ipv6-enforcement"],
12+
config_schema = "configs/schema.ncl",
13+
health_endpoint = "/health",
14+
metrics_endpoint = "/metrics",
15+
deployment_mode = "kubectl",
16+
namespace = "ipv6-enforcer",
17+
}

‎justfile‎

Lines changed: 47 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,61 @@
1-
# SPDX-License-Identifier: AGPL-3.0-or-later
2-
# Justfile - hyperpolymath standard task runner
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Justfile - IPv6 site enforcer deployment automation
33

44
default:
55
@just --list
66

7-
# Build the project
8-
build:
9-
@echo "Building..."
7+
# Deploy IPv6 site enforcer to Kubernetes cluster
8+
deploy:
9+
@echo "Deploying IPv6 site enforcer..."
10+
kubectl apply -f manifests/namespace.yaml
11+
kubectl apply -f manifests/configmap.yaml
12+
kubectl apply -f manifests/deployment.yaml
13+
kubectl apply -f manifests/service.yaml
14+
kubectl apply -f manifests/networkpolicy.yaml
15+
@echo "IPv6 site enforcer deployed"
16+
@just status
1017

11-
# Run tests
12-
test:
13-
@echo "Testing..."
18+
# Remove IPv6 site enforcer from cluster
19+
undeploy:
20+
@echo "Removing IPv6 site enforcer..."
21+
kubectl delete -f manifests/ --ignore-not-found=true
22+
@echo "Cleanup complete"
23+
24+
# Show deployment status
25+
status:
26+
@echo "=== IPv6 Site Enforcer Status ==="
27+
@kubectl -n ipv6-enforcer get all 2>/dev/null || echo "Not deployed yet"
28+
29+
# Watch pod logs
30+
logs:
31+
kubectl -n ipv6-enforcer logs -f deployment/ipv6-site-enforcer --all-containers=true
32+
33+
# Validate manifests
34+
validate:
35+
@echo "Validating Kubernetes manifests..."
36+
@for file in manifests/*.yaml; do \
37+
echo "Checking $$file..."; \
38+
kubectl apply --dry-run=client -f $$file > /dev/null; \
39+
done
40+
@echo "All manifests valid"
1441

15-
# Run lints
42+
# Test DNS64 resolution
43+
test-dns64 DOMAIN="example.com":
44+
@echo "Testing DNS64 resolution for {{DOMAIN}}..."
45+
kubectl -n ipv6-enforcer exec deployment/ipv6-site-enforcer -c unbound-dns64 -- \
46+
dig AAAA {{DOMAIN}} @127.0.0.1
47+
48+
# Run lint checks
1649
lint:
1750
@echo "Linting..."
1851

52+
# Run tests
53+
test:
54+
@echo "Testing..."
55+
1956
# Clean build artifacts
2057
clean:
21-
@echo "Cleaning..."
58+
@just undeploy
2259

2360
# Format code
2461
fmt:
@@ -30,4 +67,3 @@ check: lint test
3067
# Prepare a release
3168
release VERSION:
3269
@echo "Releasing {{VERSION}}..."
33-

‎manifests/configmap.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: ipv6-enforcer-config
6+
namespace: ipv6-enforcer
7+
labels:
8+
app.kubernetes.io/name: ipv6-site-enforcer
9+
app.kubernetes.io/part-of: flatracoon
10+
data:
11+
nat64-prefix: "64:ff9b::/96"
12+
13+
unbound.conf: |
14+
server:
15+
interface: 0.0.0.0
16+
interface: ::0
17+
access-control: 0.0.0.0/0 allow
18+
access-control: ::/0 allow
19+
20+
# DNS64 synthesis: map IPv4 addresses into the NAT64 prefix
21+
module-config: "dns64 validator iterator"
22+
dns64-prefix: 64:ff9b::/96
23+
dns64-synthall: yes
24+
25+
# Performance tuning
26+
num-threads: 2
27+
msg-cache-size: 16m
28+
rrset-cache-size: 32m
29+
30+
# Logging
31+
verbosity: 1
32+
log-queries: no
33+
log-replies: no
34+
35+
# Forward to cluster DNS for internal resolution
36+
forward-zone:
37+
name: "cluster.local."
38+
forward-addr: 10.96.0.10
39+
40+
# Forward everything else to public DNS
41+
forward-zone:
42+
name: "."
43+
forward-addr: 2606:4700:4700::1111
44+
forward-addr: 2606:4700:4700::1001

‎manifests/deployment.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
# Jool NAT64 + Unbound DNS64 sidecar deployment
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: ipv6-site-enforcer
7+
namespace: ipv6-enforcer
8+
labels:
9+
app.kubernetes.io/name: ipv6-site-enforcer
10+
app.kubernetes.io/component: nat64-dns64
11+
app.kubernetes.io/part-of: flatracoon
12+
spec:
13+
replicas: 2
14+
selector:
15+
matchLabels:
16+
app.kubernetes.io/name: ipv6-site-enforcer
17+
template:
18+
metadata:
19+
labels:
20+
app.kubernetes.io/name: ipv6-site-enforcer
21+
spec:
22+
containers:
23+
- name: jool-nat64
24+
image: ghcr.io/hyperpolymath/jool-nat64:latest
25+
ports:
26+
- containerPort: 8080
27+
name: health
28+
protocol: TCP
29+
env:
30+
- name: NAT64_PREFIX
31+
valueFrom:
32+
configMapKeyRef:
33+
name: ipv6-enforcer-config
34+
key: nat64-prefix
35+
livenessProbe:
36+
httpGet:
37+
path: /health
38+
port: health
39+
initialDelaySeconds: 10
40+
periodSeconds: 30
41+
readinessProbe:
42+
httpGet:
43+
path: /health
44+
port: health
45+
initialDelaySeconds: 5
46+
periodSeconds: 10
47+
resources:
48+
requests:
49+
cpu: 100m
50+
memory: 128Mi
51+
limits:
52+
cpu: 500m
53+
memory: 256Mi
54+
securityContext:
55+
capabilities:
56+
add:
57+
- NET_ADMIN
58+
- NET_RAW
59+
60+
- name: unbound-dns64
61+
image: mvance/unbound:latest
62+
ports:
63+
- containerPort: 53
64+
name: dns-udp
65+
protocol: UDP
66+
- containerPort: 53
67+
name: dns-tcp
68+
protocol: TCP
69+
volumeMounts:
70+
- name: unbound-config
71+
mountPath: /opt/unbound/etc/unbound/unbound.conf
72+
subPath: unbound.conf
73+
readOnly: true
74+
resources:
75+
requests:
76+
cpu: 50m
77+
memory: 64Mi
78+
limits:
79+
cpu: 200m
80+
memory: 128Mi
81+
82+
volumes:
83+
- name: unbound-config
84+
configMap:
85+
name: ipv6-enforcer-config
86+
items:
87+
- key: unbound.conf
88+
path: unbound.conf

‎manifests/namespace.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: ipv6-enforcer
6+
labels:
7+
app.kubernetes.io/part-of: flatracoon

‎manifests/networkpolicy.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: ipv6-site-enforcer
6+
namespace: ipv6-enforcer
7+
labels:
8+
app.kubernetes.io/name: ipv6-site-enforcer
9+
app.kubernetes.io/part-of: flatracoon
10+
spec:
11+
podSelector:
12+
matchLabels:
13+
app.kubernetes.io/name: ipv6-site-enforcer
14+
policyTypes:
15+
- Ingress
16+
- Egress
17+
ingress:
18+
# Allow DNS queries from any namespace
19+
- ports:
20+
- port: 53
21+
protocol: UDP
22+
- port: 53
23+
protocol: TCP
24+
- port: 8080
25+
protocol: TCP
26+
egress:
27+
# Allow DNS forwarding to cluster DNS and public resolvers
28+
- ports:
29+
- port: 53
30+
protocol: UDP
31+
- port: 53
32+
protocol: TCP
33+
# Allow NAT64 translated traffic (HTTP/HTTPS)
34+
- ports:
35+
- port: 80
36+
protocol: TCP
37+
- port: 443
38+
protocol: TCP

‎manifests/service.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: ipv6-site-enforcer
6+
namespace: ipv6-enforcer
7+
labels:
8+
app.kubernetes.io/name: ipv6-site-enforcer
9+
app.kubernetes.io/part-of: flatracoon
10+
spec:
11+
type: ClusterIP
12+
selector:
13+
app.kubernetes.io/name: ipv6-site-enforcer
14+
ports:
15+
- name: dns-udp
16+
port: 53
17+
targetPort: dns-udp
18+
protocol: UDP
19+
- name: dns-tcp
20+
port: 53
21+
targetPort: dns-tcp
22+
protocol: TCP
23+
- name: health
24+
port: 8080
25+
targetPort: health
26+
protocol: TCP

0 commit comments

Comments
 (0)