Struct Bind9Config 

pub struct Bind9Config {
    pub recursion: Option<bool>,
    pub allow_query: Option<Vec<String>>,
    pub allow_transfer: Option<Vec<String>>,
    pub dnssec: Option<DNSSECConfig>,
    pub forwarders: Option<Vec<String>>,
    pub listen_on: Option<Vec<String>>,
    pub listen_on_v6: Option<Vec<String>>,
    pub rndc_secret_ref: Option<RndcSecretRef>,
    pub bindcar_config: Option<BindcarConfig>,
}

BIND9 server configuration options

These settings configure the BIND9 DNS server behavior including recursion, access control lists, DNSSEC, and network listeners.

Fields

recursion: Option<bool>

Enable or disable recursive DNS queries

When enabled (true), the DNS server will recursively resolve queries by contacting other authoritative nameservers. When disabled (false), the server only answers for zones it is authoritative for.

Default: false (authoritative-only mode)

Important: Recursive resolvers should not be publicly accessible due to security risks (DNS amplification attacks, cache poisoning).

allow_query: Option<Vec<String>>

Access control list for DNS queries

Specifies which IP addresses or networks are allowed to query this DNS server. Supports CIDR notation and special keywords.

Default: Not set (BIND9 defaults to localhost only)

Examples:

• ["0.0.0.0/0"] - Allow queries from any IPv4 address
• ["10.0.0.0/8", "172.16.0.0/12"] - Allow queries from private networks
• ["any"] - Allow queries from any IP (IPv4 and IPv6)
• ["none"] - Deny all queries
• ["localhost"] - Allow only from localhost

allow_transfer: Option<Vec<String>>

Access control list for zone transfers (AXFR/IXFR)

Specifies which IP addresses or networks are allowed to perform zone transfers from this server. Zone transfers are used for replication between primary and secondary DNS servers.

Default: Auto-detected cluster Pod CIDRs (e.g., ["10.42.0.0/16"])

Examples:

• ["10.42.0.0/16"] - Allow transfers from specific Pod network
• ["10.0.0.0/8"] - Allow transfers from entire private network
• [] - Deny all zone transfers (empty list means “none”)
• ["any"] - Allow transfers from any IP (not recommended for production)

Can be overridden at cluster level via spec.primary.allowTransfer or spec.secondary.allowTransfer for role-specific ACLs.

dnssec: Option<DNSSECConfig>

DNSSEC (DNS Security Extensions) configuration

Configures DNSSEC signing and validation. DNSSEC provides cryptographic authentication of DNS data to prevent spoofing and cache poisoning attacks.

See DNSSECConfig for detailed options.

forwarders: Option<Vec<String>>

DNS forwarders for recursive resolution

List of upstream DNS servers to forward queries to when recursion is enabled. Used for hybrid authoritative/recursive configurations.

Only relevant when recursion: true.

Examples:

• ["8.8.8.8", "8.8.4.4"] - Google Public DNS
• ["1.1.1.1", "1.0.0.1"] - Cloudflare DNS
• ["10.0.0.53"] - Internal corporate DNS resolver

listen_on: Option<Vec<String>>

IPv4 addresses to listen on for DNS queries

Specifies which IPv4 interfaces and ports the DNS server should bind to.

Default: All IPv4 interfaces on port 53

Examples:

• ["any"] - Listen on all IPv4 interfaces
• ["127.0.0.1"] - Listen only on localhost
• ["10.0.0.1"] - Listen on specific IP address

listen_on_v6: Option<Vec<String>>

IPv6 addresses to listen on for DNS queries

Specifies which IPv6 interfaces and ports the DNS server should bind to.

Default: All IPv6 interfaces on port 53 (if IPv6 is available)

Examples:

• ["any"] - Listen on all IPv6 interfaces
• ["::1"] - Listen only on IPv6 localhost
• ["none"] - Disable IPv6 listening

rndc_secret_ref: Option<RndcSecretRef>

Reference to an existing Kubernetes Secret containing RNDC key.

If specified at the global config level, all instances in the cluster will use this existing Secret instead of auto-generating individual secrets, unless overridden at the role (primary/secondary) or instance level.

This allows centralized RNDC key management for the entire cluster.

Precedence order (highest to lowest):

1. Instance level (spec.rndcSecretRef)
2. Role level (spec.primary.rndcSecretRef or spec.secondary.rndcSecretRef)
3. Global level (spec.global.rndcSecretRef)
4. Auto-generated (default)

bindcar_config: Option<BindcarConfig>

Bindcar RNDC API sidecar container configuration.

The API container provides an HTTP interface for managing zones via rndc. This configuration is inherited by all instances unless overridden.

Trait Implementations

impl Clone for Bind9Config

fn clone(&self) -> Bind9Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Bind9Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Bind9Config

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Bind9Config

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for Bind9Config

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.