feat: Package the internal DNS control plane and serving agents

.github/workflows/publish.yml

@@ -43,3 +43,53 @@ jobs:
       # release would not even match each other.
       image-overlays: config/manager,config/agent,config/components/dns-mcp
     secrets: inherit
+
+  publish-internal-dns-runtime:
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+      attestations: write
+    uses: datum-cloud/actions/.github/workflows/publish-docker.yaml@v1.14.0
+    with:
+      image-name: internal-dns
+      dockerfile-path: config/internal-dns/Dockerfile
+      target: runtime
+      platforms: linux/amd64,linux/arm64
+    secrets: inherit
+
+  publish-internal-dns-serving:
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+      attestations: write
+    uses: datum-cloud/actions/.github/workflows/publish-docker.yaml@v1.14.0
+    with:
+      image-name: internal-dns-serving
+      dockerfile-path: config/internal-dns/Dockerfile
+      target: serving
+      platforms: linux/amd64,linux/arm64
+    secrets: inherit
+
+  publish-internal-dns-builds:
+    if: github.event_name == 'release' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/fix/internal-dns-name-references' || startsWith(github.ref, 'refs/tags/')))
+    needs: [publish-internal-dns-runtime, publish-internal-dns-serving, publish-kustomize-bundles]
+    permissions:
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: fluxcd/flux2/action@v2.7.5
+      - name: Publish the runtime and serving image pair
+        env:
+          RUNTIME_TAG: ${{ needs.publish-internal-dns-runtime.outputs.tag }}
+          SERVING_TAG: ${{ needs.publish-internal-dns-serving.outputs.tag }}
+        run: hack/publish-internal-dns-channel.sh

cmd/internal-dns-coredns/main.go

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"runtime/debug"
+
+	"go.miloapis.com/dns-operator/internal/internaldns/coredns"
+)
+
+func main() {
+	flags := flag.NewFlagSet("coredns", flag.ExitOnError)
+	var path string
+	var validate, version bool
+	flags.StringVar(&path, "config", "", "Absolute path to the DNS context snapshot")
+	flags.BoolVar(&validate, "validate", false, "Validate the DNS context snapshot and exit")
+	flags.BoolVar(&version, "version", false, "Print the CoreDNS version and exit")
+	if err := flags.Parse(os.Args[1:]); err != nil {
+		os.Exit(2)
+	}
+	if version {
+		version := "unknown"
+		if info, ok := debug.ReadBuildInfo(); ok {
+			for _, dep := range info.Deps {
+				if dep.Path == "github.com/coredns/coredns" {
+					version = dep.Version
+				}
+			}
+		}
+		fmt.Printf("CoreDNS %s; dnscontext plugin\n", version)
+		return
+	}
+	var err error
+	if validate {
+		_, err = coredns.Load(path)
+	} else {
+		ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+		defer cancel()
+		err = coredns.Run(ctx, path)
+	}
+	if err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "CoreDNS: %v\n", err)
+		os.Exit(1)
+	}
+}

cmd/internal-dns/main.go

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	internruntime "go.miloapis.com/dns-operator/internal/internaldns/runtime"
+	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+)
+
+func main() {
+	var role, configPath, kubeconfig string
+	flag.StringVar(&role, "role", "", "Process role: control-plane, agent, serving, readiness, or prepare")
+	flag.StringVar(&configPath, "config", "", "Absolute path to the internal DNS JSON configuration")
+	// controller-runtime/client-go may install this standard flag from an init
+	// hook. Reuse it when present so the command keeps one stable contract.
+	if flag.Lookup("kubeconfig") == nil {
+		flag.StringVar(&kubeconfig, "kubeconfig", "", "Control-plane Kubernetes configuration; ignored by serving processes")
+	}
+	logOptions := zap.Options{Development: false}
+	logOptions.BindFlags(flag.CommandLine)
+	flag.Parse()
+	if existing := flag.Lookup("kubeconfig"); existing != nil {
+		kubeconfig = existing.Value.String()
+	}
+	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&logOptions)))
+
+	cfg, err := internruntime.LoadConfig(configPath)
+	if err == nil {
+		err = internruntime.Run(ctrl.SetupSignalHandler(), role, cfg, kubeconfig)
+	}
+	if err != nil {
+		_, _ = fmt.Fprintf(os.Stderr, "internal-dns: %v\n", err)
+		os.Exit(1)
+	}
+}

config/internal-dns/Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1.7
+
+FROM --platform=$BUILDPLATFORM golang:1.26 AS build
+ARG TARGETOS=linux
+ARG TARGETARCH
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY cmd/internal-dns ./cmd/internal-dns
+COPY cmd/internal-dns-coredns ./cmd/internal-dns-coredns
+COPY api ./api
+COPY internal ./internal
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build -trimpath -tags netgo,osusergo -ldflags='-s -w' \
+    -o /out/internal-dns ./cmd/internal-dns && \
+    CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath -o /out/coredns ./cmd/internal-dns-coredns
+
+FROM scratch AS runtime
+COPY --from=build /out/internal-dns /internal-dns
+USER 65532:65532
+ENTRYPOINT ["/internal-dns"]
+
+FROM powerdns/dnsdist-20:2.0.10@sha256:24ac720af997aff6b98cb5b50d748754f815428e07b5368dfb0eccd5aa8d07e8 AS serving
+USER 0:0
+RUN apt-get update && apt-get install --no-install-recommends -y \
+    pdns-recursor iproute2 procps netcat-openbsd ca-certificates bash && \
+    rm -rf /var/lib/apt/lists/*
+COPY --from=build /out/internal-dns /internal-dns
+COPY --from=build /out/coredns /usr/local/bin/coredns
+COPY config/internal-dns/commands/ /usr/local/sbin/
+USER 65532:65532
+RUN for tool in bash ip nc coredns dnsdist pdns_recursor; do \
+      command -v "$tool" >/dev/null || exit 1; \
+    done && test -x /internal-dns && coredns -version
+RUN for helper in /usr/local/sbin/internal-dns-*; do \
+      test -x "$helper" && bash -n "$helper" || exit 1; \
+    done
+ENTRYPOINT ["/internal-dns"]

config/internal-dns/Dockerfile.dockerignore

@@ -0,0 +1,6 @@
+**
+!**/*.go
+**/*_test.go
+!go.mod
+!go.sum
+!config/internal-dns/commands/**