# Kubernetes Deployment

Deploy bindcar to Kubernetes using the sidecar pattern.

## Prerequisites

- Kubernetes 1.24 or later
- kubectl configured with cluster access
- BIND9 container image

## Sidecar Pattern

bindcar runs alongside BIND9 in the same pod, sharing a volume for zone files.

### Architecture

```
┌─────────────────────────────────────┐
│             Pod                      │
│  ┌──────────────┐  ┌─────────────┐ │
│  │    BIND9     │  │  bindcar    │ │
│  │  Container   │  │  Container  │ │
│  │    :53       │  │   :8080     │ │
│  └──────────────┘  └─────────────┘ │
│         │                │          │
│         └────────────────┘          │
│        emptyDir Volume               │
│       /var/cache/bind                │
└─────────────────────────────────────┘
```

## Basic Deployment

### Pod Specification

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: dns-server
  labels:
    app: dns
spec:
  containers:
  # BIND9 Container
  - name: bind9
    image: ubuntu/bind9:latest
    ports:
    - name: dns-tcp
      containerPort: 53
      protocol: TCP
    - name: dns-udp
      containerPort: 53
      protocol: UDP
    volumeMounts:
    - name: zones
      mountPath: /var/cache/bind
    - name: config
      mountPath: /etc/bind

  # bindcar Container
  - name: bindcar
    image: ghcr.io/firestoned/bindcar:latest
    ports:
    - name: api
      containerPort: 8080
      protocol: TCP
    env:
    - name: BIND_ZONE_DIR
      value: "/var/cache/bind"
    - name: API_PORT
      value: "8080"
    - name: RUST_LOG
      value: "info"
    - name: DISABLE_AUTH
      value: "false"
    volumeMounts:
    - name: zones
      mountPath: /var/cache/bind
    livenessProbe:
      httpGet:
        path: /api/v1/health
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 10
    readinessProbe:
      httpGet:
        path: /api/v1/ready
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 5

  volumes:
  - name: zones
    emptyDir: {}
  - name: config
    configMap:
      name: bind9-config
```

### Deployment

For production, use a Deployment for replica management:

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dns-server
spec:
  replicas: 1  # BIND9 typically runs as single instance
  selector:
    matchLabels:
      app: dns
  template:
    metadata:
      labels:
        app: dns
    spec:
      containers:
      - name: bind9
        image: ubuntu/bind9:latest
        # ... (same as pod spec)
      - name: bindcar
        image: ghcr.io/firestoned/bindcar:latest
        # ... (same as pod spec)
```

### Service

Expose bindcar API:

```yaml
apiVersion: v1
kind: Service
metadata:
  name: bindcar-api
spec:
  selector:
    app: dns
  ports:
  - name: api
    port: 8080
    targetPort: 8080
    protocol: TCP
  type: ClusterIP
```

Expose BIND9 DNS:

```yaml
apiVersion: v1
kind: Service
metadata:
  name: dns-service
spec:
  selector:
    app: dns
  ports:
  - name: dns-tcp
    port: 53
    protocol: TCP
  - name: dns-udp
    port: 53
    protocol: UDP
  type: LoadBalancer  # or NodePort
```

## Authentication

### ServiceAccount

Create a ServiceAccount for API clients:

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bindcar-client
  namespace: default
```

### Get Token

```bash
# Kubernetes 1.24+
TOKEN=$(kubectl create token bindcar-client)

# Use token
curl -H "Authorization: Bearer $TOKEN" \
  http://bindcar-api:8080/api/v1/zones
```

### RBAC (Optional)

Limit what the bindcar service account can do:

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bindcar
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: bindcar-role
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: bindcar-binding
subjects:
- kind: ServiceAccount
  name: bindcar
roleRef:
  kind: Role
  name: bindcar-role
  apiGroup: rbac.authorization.k8s.io
```

## ConfigMap for BIND9

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: bind9-config
data:
  named.conf: |
    options {
      directory "/var/cache/bind";
      listen-on { any; };
      listen-on-v6 { any; };
      allow-query { any; };
    };

    controls {
      inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
    };

    key "rndc-key" {
      algorithm hmac-sha256;
      secret "your-secret-key-here";
    };
```

## Persistent Storage

For production, use PersistentVolumes:

```yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: bind9-zones
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
---
# In pod spec:
volumes:
- name: zones
  persistentVolumeClaim:
    claimName: bind9-zones
```

## Resource Limits

```yaml
containers:
- name: bindcar
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi
```

## Security Context

Run as non-root:

```yaml
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  fsGroup: 1000
  readOnlyRootFilesystem: true
```

## Network Policies

Restrict traffic to bindcar:

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bindcar-netpol
spec:
  podSelector:
    matchLabels:
      app: dns
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: trusted-namespace
    ports:
    - protocol: TCP
      port: 8080
```

## Complete Example

Deploy everything:

```bash
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
  name: dns-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bindcar
  namespace: dns-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dns-server
  namespace: dns-system
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dns
  template:
    metadata:
      labels:
        app: dns
    spec:
      serviceAccountName: bindcar
      containers:
      - name: bind9
        image: ubuntu/bind9:latest
        ports:
        - containerPort: 53
          name: dns
        volumeMounts:
        - name: zones
          mountPath: /var/cache/bind
      - name: bindcar
        image: ghcr.io/firestoned/bindcar:latest
        ports:
        - containerPort: 8080
          name: api
        env:
        - name: BIND_ZONE_DIR
          value: "/var/cache/bind"
        - name: RUST_LOG
          value: "info"
        volumeMounts:
        - name: zones
          mountPath: /var/cache/bind
        livenessProbe:
          httpGet:
            path: /api/v1/health
            port: 8080
        readinessProbe:
          httpGet:
            path: /api/v1/ready
            port: 8080
      volumes:
      - name: zones
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: bindcar-api
  namespace: dns-system
spec:
  selector:
    app: dns
  ports:
  - port: 8080
    targetPort: 8080
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: dns-service
  namespace: dns-system
spec:
  selector:
    app: dns
  ports:
  - name: dns-tcp
    port: 53
    protocol: TCP
  - name: dns-udp
    port: 53
    protocol: UDP
  type: LoadBalancer
EOF
```

## Verify Deployment

```bash
# Check pods
kubectl get pods -n dns-system

# Check services
kubectl get svc -n dns-system

# Test health
kubectl port-forward -n dns-system svc/bindcar-api 8080:8080
curl http://localhost:8080/api/v1/health

# Check logs
kubectl logs -n dns-system -l app=dns -c bindcar
```

## Troubleshooting

See [Troubleshooting](./troubleshooting.md) for common issues.

## Next Steps

- [Configuration](./configuration.md) - Configure bindcar
- [Monitoring](./monitoring.md) - Monitor your deployment
- [Troubleshooting](./troubleshooting.md) - Debug issues
