Configurable cluster domain

README.md

@@ -350,6 +350,7 @@ The following settings can be optionally set to customize the node labels and ta
 The following settings are set for you automatically by [pluto](sources/api/) based on runtime instance information, but you can override them if you know what you're doing!
 * `settings.kubernetes.max-pods`: The maximum number of pods that can be scheduled on this node (limited by number of available IPv4 addresses)
 * `settings.kubernetes.cluster-dns-ip`: The CIDR block of the primary network interface.
+* `settings.kubernetes.cluster-domain`: The cluster domain is set to `cluster.local` by default.
 * `settings.kubernetes.node-ip`: The IPv4 address of this node.
 * `settings.kubernetes.pod-infra-container-image`: The URI of the "pause" container.
 

packages/kubernetes-1.15/kubelet-config

@@ -15,7 +15,7 @@ authorization:
   webhook:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
-clusterDomain: cluster.local
+clusterDomain: {{settings.kubernetes.cluster-domain}}
 clusterDNS:
 - {{settings.kubernetes.cluster-dns-ip}}
 resolvConf: "/etc/resolv.conf"

packages/kubernetes-1.16/kubelet-config

@@ -15,7 +15,7 @@ authorization:
   webhook:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
-clusterDomain: cluster.local
+clusterDomain: {{settings.kubernetes.cluster-domain}}
 clusterDNS:
 - {{settings.kubernetes.cluster-dns-ip}}
 resolvConf: "/etc/resolv.conf"

packages/kubernetes-1.17/kubelet-config

@@ -15,7 +15,7 @@ authorization:
   webhook:
     cacheAuthorizedTTL: 5m0s
     cacheUnauthorizedTTL: 30s
-clusterDomain: cluster.local
+clusterDomain: {{settings.kubernetes.cluster-domain}}
 clusterDNS:
 - {{settings.kubernetes.cluster-dns-ip}}
 resolvConf: "/etc/resolv.conf"

sources/models/defaults.toml

@@ -92,3 +92,8 @@ template-path = "/usr/share/templates/chrony-conf"
 
 [metadata.settings.ntp]
 affected-services = ["chronyd"]
+
+# Kubernetes
+
+[settings.kubernetes]
+cluster-domain = "cluster.local"

sources/models/src/lib.rs

@@ -76,7 +76,7 @@ use std::collections::HashMap;
 use std::net::Ipv4Addr;
 
 use crate::modeled_types::{
-    FriendlyVersion, KubernetesClusterName, KubernetesLabelKey, KubernetesLabelValue,
+    DNSDomain, FriendlyVersion, KubernetesClusterName, KubernetesLabelKey, KubernetesLabelValue,
     KubernetesTaintValue, SingleLineString, Url, ValidBase64,
 };
 
@@ -94,6 +94,7 @@ struct KubernetesSettings {
     // Dynamic settings.
     max_pods: u32,
     cluster_dns_ip: Ipv4Addr,
+    cluster_domain: DNSDomain,
     node_ip: Ipv4Addr,
     pod_infra_container_image: SingleLineString,
 }

sources/models/src/modeled_types/mod.rs

@@ -44,6 +44,9 @@ pub mod error {
 
         #[snafu(display("Given invalid cluster name '{}': {}", name, msg))]
         InvalidClusterName { name: String, msg: String },
+
+        #[snafu(display("Invalid domain name '{}'", input))]
+        InvalidDomainName { input: String },
     }
 }
 

sources/models/src/modeled_types/shared.rs

@@ -349,3 +349,77 @@ mod test_version {
         }
     }
 }
+
+// =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
+
+/// DNSDomain represents a string that is a valid DNS domain. It stores the
+/// original string and makes it accessible through standard traits. Its purpose
+/// is input validation, for example validating the kubelet's "clusterDomain"
+/// config value.
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+pub struct DNSDomain {
+    inner: String,
+}
+
+impl TryFrom<&str> for DNSDomain {
+    type Error = error::Error;
+
+    fn try_from(input: &str) -> Result<Self, Self::Error> {
+        ensure!(input.len() <= 253, error::InvalidDomainName { input });
+
+        let labels = input.split(".");
+        for (i, label) in labels.enumerate() {
+            ensure!(i < 127, error::InvalidDomainName { input });
+            ensure!(label.len() <= 63, error::InvalidDomainName { input });
+            let last = label.len() - 1;
+            for (j, c) in label.chars().enumerate() {
+                ensure!(
+                    (j != 0 && j != last && (c.is_alphanumeric() || c == '-'))
+                        || c.is_alphanumeric(),
+                    error::InvalidDomainName { input }
+                );
+            }
+        }
+
+        Ok(Self {
+            inner: input.to_string(),
+        })
+    }
+}
+
+string_impls_for!(DNSDomain, "DNSDomain");
+
+#[cfg(test)]
+mod test_dns_domain {
+    use super::DNSDomain;
+    use std::convert::TryFrom;
+
+    #[test]
+    fn valid_dns_domain() {
+        for ok in &[
+            "cluster.local",
+            "dev.eks",
+            "stage.eks",
+            "prod.eks",
+            "1-good.local",
+            &"a".repeat(63),
+            &format!("a{}", ".a".repeat(126)),
+        ] {
+            assert!(DNSDomain::try_from(*ok).is_ok());
+        }
+    }
+
+    #[test]
+    fn invalid_dns_domain() {
+        for err in &[
+            "-bad.com",
+            "bad-.com",
+            "-bad-.com",
+            "b_ad.com",
+            &"a".repeat(64),
+            &format!("a{}", ".a".repeat(127)),
+        ] {
+            assert!(DNSDomain::try_from(*err).is_err());
+        }
+    }
+}