Project
Authoritative DNS with GitOps
Designing authoritative DNS for an on-premises environment so that zones and servers are managed as code.
What it is
An evaluation and design effort to modernise authoritative DNS in an on-premises environment: DNS servers provisioned declaratively, zones managed through a GitOps-style workflow, and integration with Kubernetes through ExternalDNS.
Why it exists
Traditional DNS setups drift. If the servers and zones aren’t managed as code, consistency depends on people remembering to do the same thing in the same way in several places.
How it works
- DNS server VMs are provisioned via Terraform.
- PowerDNS, Knot DNS and BIND are being evaluated for the authoritative role.
- Zones and records are intended to flow through a review-and-apply workflow rather than manual edits.
- Kubernetes
ExternalDNSconnects service records back into the DNS setup. - Caching and forwarding are handled separately from authoritative serving.
Notes
- This is genuinely an evaluation and design at this stage, not a finished rollout.
- See the draft write-up for the reasoning.
Status
Prototype / evaluation.