2025/dns

k8s/dns-cache/deployment.jsonnet

@@ -1,4 +1,4 @@
-local commit = 'ae5a0d23fd293e7e1437519b816480cd01dba5f2';
+local commit = 'd1e9b4c9ca3f068c5eae56e99b52a4dcd4f21110';
 
 local tls_cert_secret = 'cert-resolver-rubykaigi-net';
 

tf/core/vpc.tf

@@ -106,6 +106,17 @@ resource "aws_subnet" "d_private" {
     "kubernetes.io/cluster/rknet"     = "shared"
   }
 }
+resource "aws_ec2_subnet_cidr_reservation" "c_private" {
+  subnet_id        = aws_subnet.c_private.id
+  cidr_block       = cidrsubnet(aws_subnet.c_private.cidr_block, 5, 0) # .0-.63
+  reservation_type = "explicit"
+}
+resource "aws_ec2_subnet_cidr_reservation" "d_private" {
+  subnet_id        = aws_subnet.d_private.id
+  cidr_block       = cidrsubnet(aws_subnet.d_private.cidr_block, 5, 0) # .0-.63
+  reservation_type = "explicit"
+}
+
 
 resource "aws_subnet" "c_onpremises" {
   availability_zone               = "ap-northeast-1c"

tf/dns-cache/elb.tf

@@ -2,11 +2,17 @@ resource "aws_lb" "nlb" {
   name               = "dns-cache-${substr(uuid(), 0, 10)}"
   internal           = true
   load_balancer_type = "network"
-  subnets            = [for s in local.nlb_subnets : s.id]
+
+  dynamic "subnet_mapping" {
+    for_each = tomap(local.nlb_subnets)
+    content {
+      subnet_id            = subnet_mapping.value.id
+      private_ipv4_address = cidrhost(subnet_mapping.value.cidr_block, 53)
+    }
+  }
 
   lifecycle {
-    create_before_destroy = true
-    ignore_changes        = [name]
+    ignore_changes = [name]
   }
 }