Dynamic Zones

High-Level Summary

Dynamic Zones allow k8gb to serve DNS zones only when applications are deployed, solving the problem of premature NXDOMAIN responses in anonymous, multi-tenant, or shared clusters. By introducing a new cluster-scoped resource, ZoneDelegation, k8gb dynamically detects which zones a cluster should serve and configures CoreDNS automatically.

This provides: - Accurate DNS behavior (no premature NXDOMAIN) - Declarative onboarding - Automatic CoreDNS reconfiguration without restarts - Safe cleanup when zones are removed - Reduced DNS lookup overhead by using ZoneDelegation status as the source of DNS server IPs

---

Dynamic Zones (Feature)

The feature introduces a cluster-scoped resource ZoneDelegation that contains:

• loadBalancedZone
• parentZone
• dnsZoneNegTTL
• doFinalize

Why Dynamic Zones?

Pre-configuring zones in anonymous or shared clusters makes CoreDNS authoritative too early, causing NXDOMAIN responses. ZoneDelegation lets applications ship their own zone definitions, enabling dynamic activation.

Example

apiVersion: k8gb.io/v1beta1
kind: ZoneDelegation
metadata:
  name: test-zone
spec:
  loadBalancedZone: test-zone.cloud.example.com
  parentZone: cloud.example.com
  dnsZoneNegTTL: 30
  doFinalize: true

Setup

Set k8gb.dynamicZones to true via helm chart values. This will add a new empty ConfigMap named dynamic-zones. Every ZoneDelegation reconcile loop, k8gb will get all ZoneDelegations and create configmap key per ZoneDelegation like:

apiVersion: v1
data:
  test-zone-cloud-example-com.conf: |2-
    test-zone.cloud.example.com:5353 {
      import k8gbplugins
    }
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: k8gb
    meta.helm.sh/release-namespace: k8gb
  labels:
    app.kubernetes.io/managed-by: Helm
  name: k8gb-zone-delegation

This configmap is mounted into CoreDNS pod and imported with import plugin:

apiVersion: v1
data:
  Corefile: |-
    (k8gbplugins) {
        errors
        health
        reload 30s 15s
        ready
        prometheus 0.0.0.0:9153
        forward . /etc/resolv.conf
        k8s_crd {
            filter k8gb.absa.oss/dnstype=local
            negttl 30
            loadbalance weight
        }
    }
    static-zone.cloud.example.com:5353 {
        import k8gbplugins
    }
    import ../dynamic/*.conf

ZoneDelegation Status

The ZoneDelegation status contains information about all DNS servers participating in zone delegation. It acts as the single source of truth for DNS server IP addresses used by the k8gb controller, delegation DNSEndpoints when the ExternalDNS provider is enabled, and application DNSEndpoints. k8gb reads DNS server IP addresses from this status, which avoids resolving them from edgeDNS on every reconciliation. The refresh interval is controlled by the k8gb reconcile interval, configured through k8gb.reconcileRequeueSeconds in Helm values or the corresponding RECONCILE_REQUEUE_SECONDS environment variable.

status:
  dnsServers:
    - name: gslb-ns-eu-cloud2.example.com
      address: 172.18.0.6
    - name: gslb-ns-eu-cloud2.example.com
      address: 172.18.0.7
    - name: gslb-ns-us-cloud2.example.com
      address: 172.18.0.11
    - name: gslb-ns-us-cloud2.example.com
      address: 172.18.0.12

ZoneDelegation Cleanup (WIP)

Use doFinalize: false when k8gb should not modify the parent DNS delegation during deletion; the controller only removes this cluster's local CoreDNS configuration. Use doFinalize: true when k8gb is allowed to remove the delegated zone from the parent DNS during cleanup.

Delayed Finalization

When doFinalize is enabled, deleting a ZoneDelegation may not remove the object immediately. The object can remain in a terminating state while the k8gb controller verifies whether the current cluster is the last remaining member of the delegation. This prevents premature deletion of the delegated zone from the parent DNS in multi-cluster environments.

metadata:
  deletionTimestamp: ...
  finalizers:
    - k8gb.io/finalizer

Infoblox provider

When ZoneDelegation is removed with the Infoblox provider, the delegated zone is deleted only when the last ZoneDelegation object is removed. The zone is deleted directly by the Infoblox provider, which is part of k8gb.

ExternalDNS provider

When ZoneDelegation is removed with the ExternalDNS provider, delegation DNSEndpoint objects must not be deleted immediately. Instead, deleting a ZoneDelegation removes the current cluster target from the delegation DNSEndpoint and removes the zone configuration from the k8gb-zone-delegation ConfigMap. The ZoneDelegation object then remains blocked by its finalizer. The last remaining ZoneDelegation object no longer has information about any other participating clusters, so it can be finalized and deleted. The remaining ZoneDelegation objects are finalized automatically after they lose information about the last cluster. Together with the ZoneDelegation objects, the delegation DNSEndpoint objects are deleted as well. This allows the ExternalDNS provider to remove the delegated zone from the parent DNS.

Backward Compatibility

Static zones configured through k8gb.dnsZones remain supported. Dynamic Zones are an additional mechanism for environments where zones should be activated only when ZoneDelegation objects are created. For backward compatibility, ZoneDelegation objects generated from k8gb.dnsZones or the DNS_ZONES environment variable have doFinalize set to false by default. This prevents k8gb from deleting delegated zones that were originally configured as static zones.