Integrating HashiCorp Vault with CoreDNS: Secure DNS and Secrets Management

Table of Contents#

Overview#

Integrating HashiCorp Vault with CoreDNS creates a powerful combination for managing DNS records securely while leveraging Vault’s dynamic secrets and PKI capabilities. This integration enables secure DNS resolution, automatic certificate management, and dynamic DNS record updates based on Vault policies.

Architecture Overview#

1
graph TB
2
    subgraph "HashiCorp Vault"
3
        A[Secrets Engine]
4
        B[PKI Engine]
5
        C[Dynamic Secrets]
6
        D[Policy Engine]
7
    end
8

9
    subgraph "CoreDNS"
10
        E[DNS Server]
11
        F[Plugin System]
12
        G[Zone Files]
13
        H[Cache Layer]
14
    end
15

16
    subgraph "Integration Layer"
17
        I[Vault Plugin]
18
        J[Auth Backend]
19
        K[Record Sync]
20
        L[Cert Manager]
21
    end
22

23
    subgraph "Clients"
24
        M[Applications]
25
        N[Services]
26
        O[Infrastructure]
27
    end
28

29
    A --> I
30
    B --> L
31
    C --> K
32
    D --> J
33

34
    I --> F
35
    J --> F
36
    K --> G
37
    L --> E
38

39
    E --> M
40
    E --> N
41
    E --> O
42

43
    style A fill:#4ecdc4,stroke:#087f5b,stroke-width:2px
44
    style E fill:#74c0fc,stroke:#1971c2,stroke-width:2px
45
    style I fill:#ffd43b,stroke:#fab005,stroke-width:2px

Setting Up HashiCorp Vault#

Vault Installation and Configuration#

1
#!/bin/bash
2
# install-vault.sh - Install and configure HashiCorp Vault
3

4
# Install Vault
5
install_vault() {
6
    # Add HashiCorp GPG key
7
    wget -O- https://apt.releases.hashicorp.com/gpg | \
8
        gpg --dearmor | \
9
        sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
10

11
    # Add HashiCorp repository
12
    echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
13
        https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
14
        sudo tee /etc/apt/sources.list.d/hashicorp.list
15

16
    # Install Vault
17
    sudo apt update
18
    sudo apt install vault
19

20
    # Create Vault configuration directory
21
    sudo mkdir -p /etc/vault.d
22
    sudo mkdir -p /opt/vault/data
23
}
24

25
# Configure Vault server
26
configure_vault() {
27
    cat << 'EOF' | sudo tee /etc/vault.d/vault.hcl
28
# Vault server configuration
29

30
# Storage backend
31
storage "raft" {
32
  path    = "/opt/vault/data"
33
  node_id = "vault-1"
34
}
35

36
# Listener configuration
37
listener "tcp" {
38
  address       = "0.0.0.0:8200"
39
  tls_cert_file = "/opt/vault/tls/vault.crt"
40
  tls_key_file  = "/opt/vault/tls/vault.key"
41
}
42

43
# API address
44
api_addr = "https://vault.example.com:8200"
45
cluster_addr = "https://vault.example.com:8201"
46

47
# UI
48
ui = true
49

50
# Telemetry
51
telemetry {
52
  prometheus_retention_time = "30s"
53
  disable_hostname = true
54
}
55

56
# Seal configuration (for auto-unseal)
57
seal "awskms" {
58
  region     = "us-east-1"
59
  kms_key_id = "alias/vault-unseal"
60
}
61
EOF
62

63
    # Create systemd service
64
    cat << 'EOF' | sudo tee /etc/systemd/system/vault.service
65
[Unit]
66
Description=HashiCorp Vault
67
Documentation=https://www.vaultproject.io/
68
Requires=network-online.target
69
After=network-online.target
70
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
71
StartLimitIntervalSec=60
72
StartLimitBurst=3
73

74
[Service]
75
Type=notify
76
EnvironmentFile=/etc/vault.d/vault.env
77
User=vault
78
Group=vault
79
ProtectSystem=full
80
ProtectHome=read-only
81
PrivateTmp=yes
82
PrivateDevices=yes
83
SecureBits=keep-caps
84
AmbientCapabilities=CAP_IPC_LOCK
85
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
86
NoNewPrivileges=yes
87
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
88
ExecReload=/bin/kill --signal HUP $MAINPID
89
KillMode=process
90
Restart=on-failure
91
RestartSec=5
92
TimeoutStopSec=30
93
LimitNOFILE=65536
94
LimitMEMLOCK=infinity
95

96
[Install]
97
WantedBy=multi-user.target
98
EOF
99

100
    # Create vault user
101
    sudo useradd --system --home /etc/vault.d --shell /bin/false vault
102
    sudo chown -R vault:vault /opt/vault /etc/vault.d
103
}
104

105
# Initialize Vault
106
initialize_vault() {
107
    # Start Vault
108
    sudo systemctl enable vault
109
    sudo systemctl start vault
110

111
    # Set Vault address
112
    export VAULT_ADDR='https://vault.example.com:8200'
113

114
    # Initialize Vault
115
    vault operator init -key-shares=5 -key-threshold=3 > vault-init.txt
116

117
    # Extract root token and unseal keys
118
    ROOT_TOKEN=$(grep 'Initial Root Token:' vault-init.txt | awk '{print $NF}')
119

120
    # Unseal Vault (automated with AWS KMS in production)
121
    for i in {1..3}; do
122
        UNSEAL_KEY=$(grep "Unseal Key $i:" vault-init.txt | awk '{print $NF}')
123
        vault operator unseal $UNSEAL_KEY
124
    done
125

126
    # Login with root token
127
    vault login $ROOT_TOKEN
128
}
129

130
# Configure Vault for DNS integration
131
configure_vault_dns() {
132
    # Enable KV secrets engine for DNS records
133
    vault secrets enable -path=dns kv-v2
134

135
    # Enable PKI secrets engine
136
    vault secrets enable pki
137
    vault secrets tune -max-lease-ttl=87600h pki
138

139
    # Generate root CA
140
    vault write -field=certificate pki/root/generate/internal \
141
        common_name="DNS Root CA" \
142
        ttl=87600h > dns_root_ca.crt
143

144
    # Configure CA and CRL URLs
145
    vault write pki/config/urls \
146
        issuing_certificates="$VAULT_ADDR/v1/pki/ca" \
147
        crl_distribution_points="$VAULT_ADDR/v1/pki/crl"
148

149
    # Create PKI role for DNS certificates
150
    vault write pki/roles/dns-cert \
151
        allowed_domains="example.com,internal.local" \
152
        allow_subdomains=true \
153
        max_ttl="720h" \
154
        require_cn=false \
155
        generate_lease=true
156

157
    # Enable intermediate CA
158
    vault secrets enable -path=pki_int pki
159
    vault secrets tune -max-lease-ttl=43800h pki_int
160

161
    # Generate intermediate CSR
162
    vault write -format=json pki_int/intermediate/generate/internal \
163
        common_name="DNS Intermediate CA" \
164
        | jq -r '.data.csr' > pki_intermediate.csr
165

166
    # Sign intermediate certificate
167
    vault write -format=json pki/root/sign-intermediate csr=@pki_intermediate.csr \
168
        format=pem_bundle ttl="43800h" \
169
        | jq -r '.data.certificate' > intermediate.cert.pem
170

171
    # Set intermediate certificate
172
    vault write pki_int/intermediate/set-signed certificate=@intermediate.cert.pem
173
}
174

175
# Create DNS record management policies
176
create_dns_policies() {
177
    # Policy for DNS record management
178
    cat << 'EOF' | vault policy write dns-admin -
179
# DNS admin policy
180
path "dns/*" {
181
  capabilities = ["create", "read", "update", "delete", "list"]
182
}
183

184
path "pki/*" {
185
  capabilities = ["create", "read", "update", "delete", "list"]
186
}
187

188
path "pki_int/*" {
189
  capabilities = ["create", "read", "update", "delete", "list"]
190
}
191
EOF
192

193
    # Policy for CoreDNS read access
194
    cat << 'EOF' | vault policy write coredns-read -
195
# CoreDNS read policy
196
path "dns/data/*" {
197
  capabilities = ["read", "list"]
198
}
199

200
path "pki/issue/dns-cert" {
201
  capabilities = ["create", "update"]
202
}
203

204
path "pki/cert/*" {
205
  capabilities = ["read"]
206
}
207
EOF
208

209
    # Create AppRole for CoreDNS
210
    vault auth enable approle
211
    vault write auth/approle/role/coredns \
212
        token_policies="coredns-read" \
213
        token_ttl=1h \
214
        token_max_ttl=4h \
215
        secret_id_ttl=720h
216

217
    # Get role ID and secret ID
218
    ROLE_ID=$(vault read -field=role_id auth/approle/role/coredns/role-id)
219
    SECRET_ID=$(vault write -field=secret_id -f auth/approle/role/coredns/secret-id)
220

221
    echo "CoreDNS AppRole credentials:"
222
    echo "Role ID: $ROLE_ID"
223
    echo "Secret ID: $SECRET_ID"
224
}
225

226
# Main installation
227
main() {
228
    echo "Installing HashiCorp Vault..."
229
    install_vault
230
    configure_vault
231
    initialize_vault
232
    configure_vault_dns
233
    create_dns_policies
234
    echo "Vault installation complete!"
235
}
236

237
main

CoreDNS with Vault Plugin#

Building CoreDNS with Vault Plugin#

1
#!/bin/bash
2
# build-coredns-vault.sh - Build CoreDNS with Vault plugin
3

4
# Clone CoreDNS
5
git clone https://github.com/coredns/coredns.git
6
cd coredns
7

8
# Add Vault plugin to plugin.cfg
9
cat << 'EOF' >> plugin.cfg
10
vault:github.com/coredns/coredns-vault
11
EOF
12

13
# Create Vault plugin
14
mkdir -p plugin/vault
15
cat << 'EOF' > plugin/vault/setup.go
16
package vault
17

18
import (
19
    "github.com/coredns/caddy"
20
    "github.com/coredns/coredns/core/dnsserver"
21
    "github.com/coredns/coredns/plugin"
22
)
23

24
func init() {
25
    plugin.Register("vault", setup)
26
}
27

28
func setup(c *caddy.Controller) error {
29
    v, err := vaultParse(c)
30
    if err != nil {
31
        return plugin.Error("vault", err)
32
    }
33

34
    dnsserver.GetConfig(c).AddPlugin(func(next plugin.Handler) plugin.Handler {
35
        v.Next = next
36
        return v
37
    })
38

39
    return nil
40
}
41
EOF
42

43
# Create main Vault plugin
44
cat << 'EOF' > plugin/vault/vault.go
45
package vault
46

47
import (
48
    "context"
49
    "fmt"
50
    "net"
51
    "strings"
52
    "time"
53

54
    "github.com/coredns/coredns/plugin"
55
    "github.com/coredns/coredns/request"
56
    "github.com/hashicorp/vault/api"
57
    "github.com/miekg/dns"
58
)
59

60
type Vault struct {
61
    Next   plugin.Handler
62
    client *api.Client
63
    path   string
64
    ttl    uint32
65
}
66

67
// ServeDNS implements the plugin.Handler interface
68
func (v *Vault) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
69
    state := request.Request{W: w, Req: r}
70
    qname := state.Name()
71
    qtype := state.QType()
72

73
    // Check if we have a record in Vault
74
    record, err := v.getRecord(qname, qtype)
75
    if err != nil {
76
        // Pass to next plugin if not found
77
        return v.Next.ServeDNS(ctx, w, r)
78
    }
79

80
    // Build response
81
    resp := new(dns.Msg)
82
    resp.SetReply(r)
83
    resp.Authoritative = true
84

85
    switch qtype {
86
    case dns.TypeA:
87
        if ip := net.ParseIP(record); ip != nil && ip.To4() != nil {
88
            rr := &dns.A{
89
                Hdr: dns.RR_Header{
90
                    Name:   qname,
91
                    Rrtype: dns.TypeA,
92
                    Class:  dns.ClassINET,
93
                    Ttl:    v.ttl,
94
                },
95
                A: ip.To4(),
96
            }
97
            resp.Answer = append(resp.Answer, rr)
98
        }
99
    case dns.TypeAAAA:
100
        if ip := net.ParseIP(record); ip != nil && ip.To16() != nil {
101
            rr := &dns.AAAA{
102
                Hdr: dns.RR_Header{
103
                    Name:   qname,
104
                    Rrtype: dns.TypeAAAA,
105
                    Class:  dns.ClassINET,
106
                    Ttl:    v.ttl,
107
                },
108
                AAAA: ip.To16(),
109
            }
110
            resp.Answer = append(resp.Answer, rr)
111
        }
112
    case dns.TypeCNAME:
113
        rr := &dns.CNAME{
114
            Hdr: dns.RR_Header{
115
                Name:   qname,
116
                Rrtype: dns.TypeCNAME,
117
                Class:  dns.ClassINET,
118
                Ttl:    v.ttl,
119
            },
120
            Target: record,
121
        }
122
        resp.Answer = append(resp.Answer, rr)
123
    case dns.TypeTXT:
124
        rr := &dns.TXT{
125
            Hdr: dns.RR_Header{
126
                Name:   qname,
127
                Rrtype: dns.TypeTXT,
128
                Class:  dns.ClassINET,
129
                Ttl:    v.ttl,
130
            },
131
            Txt: []string{record},
132
        }
133
        resp.Answer = append(resp.Answer, rr)
134
    }
135

136
    w.WriteMsg(resp)
137
    return dns.RcodeSuccess, nil
138
}
139

140
// getRecord retrieves DNS record from Vault
141
func (v *Vault) getRecord(name string, qtype uint16) (string, error) {
142
    // Normalize name
143
    name = strings.TrimSuffix(name, ".")
144

145
    // Build Vault path
146
    path := fmt.Sprintf("%s/data/%s", v.path, name)
147

148
    // Read from Vault
149
    secret, err := v.client.Logical().Read(path)
150
    if err != nil || secret == nil {
151
        return "", fmt.Errorf("record not found")
152
    }
153

154
    // Extract record based on type
155
    data, ok := secret.Data["data"].(map[string]interface{})
156
    if !ok {
157
        return "", fmt.Errorf("invalid data format")
158
    }
159

160
    var recordKey string
161
    switch qtype {
162
    case dns.TypeA:
163
        recordKey = "A"
164
    case dns.TypeAAAA:
165
        recordKey = "AAAA"
166
    case dns.TypeCNAME:
167
        recordKey = "CNAME"
168
    case dns.TypeTXT:
169
        recordKey = "TXT"
170
    default:
171
        return "", fmt.Errorf("unsupported record type")
172
    }
173

174
    value, ok := data[recordKey].(string)
175
    if !ok {
176
        return "", fmt.Errorf("record type not found")
177
    }
178

179
    return value, nil
180
}
181

182
// Name implements the Handler interface
183
func (v *Vault) Name() string { return "vault" }
184
EOF
185

186
# Build CoreDNS
187
go generate
188
go build

CoreDNS Configuration#

1
# Create CoreDNS configuration
2
cat << 'EOF' > /etc/coredns/Corefile
3
# CoreDNS configuration with Vault integration
4

5
.:53 {
6
    # Vault plugin for secure DNS records
7
    vault {
8
        address https://vault.example.com:8200
9
        token env:VAULT_TOKEN
10
        path dns
11
        ttl 300
12
    }
13

14
    # Standard plugins
15
    errors
16
    health {
17
        lameduck 5s
18
    }
19
    ready
20
    prometheus :9153
21

22
    # Cache with Vault-aware TTL
23
    cache 30 {
24
        success 9984 30
25
        denial 9984 5
26
    }
27

28
    # Forward unmatched queries
29
    forward . 8.8.8.8 8.8.4.4 {
30
        max_concurrent 1000
31
    }
32

33
    # Logging
34
    log
35
}
36

37
# Internal zone with Vault backend
38
internal.local:53 {
39
    vault {
40
        address https://vault.example.com:8200
41
        token env:VAULT_TOKEN
42
        path dns/internal
43
        ttl 60
44
    }
45

46
    # Certificate validation using Vault PKI
47
    tls {
48
        cert_path pki/issue/dns-cert
49
        key_path pki/issue/dns-cert
50
        ca_path pki/cert/ca
51
    }
52

53
    errors
54
    log
55
}
56

57
# Service discovery zone
58
service.consul:53 {
59
    vault {
60
        address https://vault.example.com:8200
61
        token env:VAULT_TOKEN
62
        path dns/consul
63
        ttl 10
64
    }
65

66
    # Consul integration
67
    consul {
68
        endpoint consul.service.consul:8500
69
    }
70

71
    errors
72
    cache 10
73
}
74
EOF

Dynamic DNS Management#

Vault DNS Record Manager#

1
#!/bin/bash
2
# vault-dns-manager.sh - Manage DNS records in Vault
3

4
# Configuration
5
VAULT_ADDR="${VAULT_ADDR:-https://vault.example.com:8200}"
6
DNS_PATH="dns"
7

8
# Login to Vault
9
vault_login() {
10
    if [[ -z "$VAULT_TOKEN" ]]; then
11
        echo "Please login to Vault:"
12
        vault login
13
    fi
14
}
15

16
# Create DNS record
17
create_dns_record() {
18
    local domain=$1
19
    local record_type=$2
20
    local value=$3
21
    local ttl=${4:-300}
22

23
    echo "Creating DNS record: $domain ($record_type) -> $value"
24

25
    vault kv put "${DNS_PATH}/${domain}" \
26
        "${record_type}=${value}" \
27
        "TTL=${ttl}" \
28
        "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
29
        "created_by=$(whoami)"
30
}
31

32
# Update DNS record
33
update_dns_record() {
34
    local domain=$1
35
    local record_type=$2
36
    local value=$3
37

38
    echo "Updating DNS record: $domain ($record_type) -> $value"
39

40
    vault kv patch "${DNS_PATH}/${domain}" \
41
        "${record_type}=${value}" \
42
        "updated=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
43
        "updated_by=$(whoami)"
44
}
45

46
# Delete DNS record
47
delete_dns_record() {
48
    local domain=$1
49
    local record_type=$2
50

51
    if [[ -z "$record_type" ]]; then
52
        echo "Deleting all records for: $domain"
53
        vault kv delete "${DNS_PATH}/${domain}"
54
    else
55
        echo "Deleting $record_type record for: $domain"
56
        vault kv patch "${DNS_PATH}/${domain}" \
57
            "${record_type}=null"
58
    fi
59
}
60

61
# List DNS records
62
list_dns_records() {
63
    local domain=$1
64

65
    if [[ -z "$domain" ]]; then
66
        echo "Listing all DNS domains:"
67
        vault kv list "${DNS_PATH}/"
68
    else
69
        echo "DNS records for $domain:"
70
        vault kv get "${DNS_PATH}/${domain}"
71
    fi
72
}
73

74
# Import zone file
75
import_zone_file() {
76
    local zone_file=$1
77
    local zone_name=$2
78

79
    echo "Importing zone file: $zone_file"
80

81
    while IFS= read -r line; do
82
        # Skip comments and empty lines
83
        [[ "$line" =~ ^[[:space:]]*# ]] && continue
84
        [[ -z "$line" ]] && continue
85

86
        # Parse DNS record
87
        if [[ "$line" =~ ^([^[:space:]]+)[[:space:]]+([0-9]+)?[[:space:]]*IN[[:space:]]+([A-Z]+)[[:space:]]+(.+)$ ]]; then
88
            local name="${BASH_REMATCH[1]}"
89
            local ttl="${BASH_REMATCH[2]:-300}"
90
            local type="${BASH_REMATCH[3]}"
91
            local value="${BASH_REMATCH[4]}"
92

93
            # Handle @ symbol
94
            [[ "$name" == "@" ]] && name="$zone_name"
95

96
            # Create record in Vault
97
            create_dns_record "$name" "$type" "$value" "$ttl"
98
        fi
99
    done < "$zone_file"
100
}
101

102
# Export to zone file
103
export_zone_file() {
104
    local output_file=$1
105
    local zone_name=$2
106

107
    echo "Exporting DNS records to: $output_file"
108

109
    cat << EOF > "$output_file"
110
; Zone file exported from Vault
111
; Generated: $(date)
112
\$ORIGIN $zone_name.
113
\$TTL 300
114

115
EOF
116

117
    # List all records and export
118
    vault kv list -format=json "${DNS_PATH}/" | jq -r '.[]' | while read -r domain; do
119
        # Get record data
120
        record_data=$(vault kv get -format=json "${DNS_PATH}/${domain}")
121

122
        # Extract records
123
        echo "$record_data" | jq -r '.data.data | to_entries[] | "\(.key) \(.value)"' | \
124
        while read -r type value; do
125
            [[ "$type" == "TTL" ]] && continue
126
            [[ "$type" =~ ^(created|updated) ]] && continue
127

128
            ttl=$(echo "$record_data" | jq -r '.data.data.TTL // 300')
129
            echo -e "${domain}\t${ttl}\tIN\t${type}\t${value}" >> "$output_file"
130
        done
131
    done
132
}
133

134
# Main menu
135
show_menu() {
136
    echo "Vault DNS Manager"
137
    echo "================="
138
    echo "1. Create DNS record"
139
    echo "2. Update DNS record"
140
    echo "3. Delete DNS record"
141
    echo "4. List DNS records"
142
    echo "5. Import zone file"
143
    echo "6. Export zone file"
144
    echo "7. Exit"
145
    echo
146
    read -p "Select option: " choice
147

148
    case $choice in
149
        1)
150
            read -p "Domain name: " domain
151
            read -p "Record type (A/AAAA/CNAME/TXT): " type
152
            read -p "Value: " value
153
            read -p "TTL (default 300): " ttl
154
            create_dns_record "$domain" "$type" "$value" "${ttl:-300}"
155
            ;;
156
        2)
157
            read -p "Domain name: " domain
158
            read -p "Record type: " type
159
            read -p "New value: " value
160
            update_dns_record "$domain" "$type" "$value"
161
            ;;
162
        3)
163
            read -p "Domain name: " domain
164
            read -p "Record type (leave empty for all): " type
165
            delete_dns_record "$domain" "$type"
166
            ;;
167
        4)
168
            read -p "Domain name (leave empty for all): " domain
169
            list_dns_records "$domain"
170
            ;;
171
        5)
172
            read -p "Zone file path: " zone_file
173
            read -p "Zone name: " zone_name
174
            import_zone_file "$zone_file" "$zone_name"
175
            ;;
176
        6)
177
            read -p "Output file path: " output_file
178
            read -p "Zone name: " zone_name
179
            export_zone_file "$output_file" "$zone_name"
180
            ;;
181
        7)
182
            exit 0
183
            ;;
184
        *)
185
            echo "Invalid option"
186
            ;;
187
    esac
188
}
189

190
# Run
191
vault_login
192
while true; do
193
    show_menu
194
    echo
195
    read -p "Press Enter to continue..."
196
    clear
197
done

Automatic Certificate Management#

Certificate Automation Flow#

1
graph TD
2
    A[Certificate Request] --> B{Vault PKI}
3
    B --> C[Validate Request]
4
    C --> D[Generate Certificate]
5
    D --> E[Sign with CA]
6
    E --> F[Return Certificate]
7

8
    F --> G[CoreDNS]
9
    F --> H[Application]
10

11
    G --> I[TLS Termination]
12
    H --> J[Service Authentication]
13

14
    K[Certificate Renewal] --> L{Check Expiry}
15
    L -->|Expiring| M[Auto-Renew]
16
    M --> B
17

18
    style B fill:#4ecdc4,stroke:#087f5b,stroke-width:2px
19
    style E fill:#74c0fc,stroke:#1971c2,stroke-width:2px
20
    style M fill:#ffd43b,stroke:#fab005,stroke-width:2px

Certificate Manager Script#

1
#!/bin/bash
2
# vault-cert-manager.sh - Automated certificate management
3

4
# Configuration
5
VAULT_ADDR="${VAULT_ADDR:-https://vault.example.com:8200}"
6
PKI_PATH="pki_int"
7
CERT_ROLE="dns-cert"
8
CERT_DIR="/etc/coredns/certs"
9

10
# Ensure certificate directory exists
11
mkdir -p "$CERT_DIR"
12

13
# Request certificate from Vault
14
request_certificate() {
15
    local common_name=$1
16
    local alt_names=$2
17
    local ttl=${3:-720h}
18

19
    echo "Requesting certificate for: $common_name"
20

21
    # Request certificate
22
    vault write -format=json "${PKI_PATH}/issue/${CERT_ROLE}" \
23
        common_name="$common_name" \
24
        alt_names="$alt_names" \
25
        ttl="$ttl" > "${CERT_DIR}/${common_name}.json"
26

27
    # Extract certificate and key
28
    jq -r '.data.certificate' "${CERT_DIR}/${common_name}.json" > "${CERT_DIR}/${common_name}.crt"
29
    jq -r '.data.private_key' "${CERT_DIR}/${common_name}.json" > "${CERT_DIR}/${common_name}.key"
30
    jq -r '.data.ca_chain[]' "${CERT_DIR}/${common_name}.json" > "${CERT_DIR}/${common_name}.ca"
31

32
    # Set permissions
33
    chmod 644 "${CERT_DIR}/${common_name}.crt"
34
    chmod 600 "${CERT_DIR}/${common_name}.key"
35
    chmod 644 "${CERT_DIR}/${common_name}.ca"
36

37
    # Create full chain
38
    cat "${CERT_DIR}/${common_name}.crt" "${CERT_DIR}/${common_name}.ca" > \
39
        "${CERT_DIR}/${common_name}.fullchain.crt"
40

41
    echo "Certificate generated:"
42
    echo "  Certificate: ${CERT_DIR}/${common_name}.crt"
43
    echo "  Private Key: ${CERT_DIR}/${common_name}.key"
44
    echo "  CA Chain: ${CERT_DIR}/${common_name}.ca"
45
    echo "  Full Chain: ${CERT_DIR}/${common_name}.fullchain.crt"
46
}
47

48
# Check certificate expiration
49
check_certificate_expiry() {
50
    local cert_file=$1
51
    local days_warning=${2:-30}
52

53
    if [[ ! -f "$cert_file" ]]; then
54
        return 1
55
    fi
56

57
    # Get expiration date
58
    expiry_date=$(openssl x509 -in "$cert_file" -noout -enddate | cut -d= -f2)
59
    expiry_epoch=$(date -d "$expiry_date" +%s)
60
    current_epoch=$(date +%s)
61

62
    # Calculate days until expiry
63
    days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
64

65
    if [[ $days_until_expiry -lt $days_warning ]]; then
66
        echo "Certificate expires in $days_until_expiry days"
67
        return 0
68
    else
69
        echo "Certificate valid for $days_until_expiry days"
70
        return 1
71
    fi
72
}
73

74
# Auto-renew certificates
75
auto_renew_certificates() {
76
    echo "Checking certificates for renewal..."
77

78
    # Find all certificate files
79
    find "$CERT_DIR" -name "*.crt" -not -name "*.fullchain.crt" -not -name "*.ca" | \
80
    while read -r cert_file; do
81
        cert_name=$(basename "$cert_file" .crt)
82

83
        echo "Checking: $cert_name"
84
        if check_certificate_expiry "$cert_file" 30; then
85
            echo "Renewing certificate: $cert_name"
86

87
            # Extract current certificate details
88
            common_name=$(openssl x509 -in "$cert_file" -noout -subject | \
89
                sed -n 's/.*CN=\([^,]*\).*/\1/p')
90

91
            # Get SANs
92
            alt_names=$(openssl x509 -in "$cert_file" -noout -text | \
93
                grep -A1 "Subject Alternative Name" | \
94
                tail -1 | sed 's/DNS://g' | tr -d ' ')
95

96
            # Request new certificate
97
            request_certificate "$common_name" "$alt_names"
98

99
            # Reload CoreDNS
100
            systemctl reload coredns
101
        fi
102
    done
103
}
104

105
# Monitor certificate health
106
monitor_certificates() {
107
    local output_file="/var/lib/prometheus/node_exporter/cert_metrics.prom"
108

109
    echo "# HELP cert_expiry_days Days until certificate expiry" > "$output_file"
110
    echo "# TYPE cert_expiry_days gauge" >> "$output_file"
111

112
    find "$CERT_DIR" -name "*.crt" -not -name "*.fullchain.crt" -not -name "*.ca" | \
113
    while read -r cert_file; do
114
        cert_name=$(basename "$cert_file" .crt)
115

116
        if [[ -f "$cert_file" ]]; then
117
            expiry_date=$(openssl x509 -in "$cert_file" -noout -enddate | cut -d= -f2)
118
            expiry_epoch=$(date -d "$expiry_date" +%s)
119
            current_epoch=$(date +%s)
120
            days_until_expiry=$(( (expiry_epoch - current_epoch) / 86400 ))
121

122
            echo "cert_expiry_days{name=\"$cert_name\"} $days_until_expiry" >> "$output_file"
123
        fi
124
    done
125
}
126

127
# Setup automatic renewal cron
128
setup_auto_renewal() {
129
    cat << 'EOF' | sudo tee /etc/cron.d/vault-cert-renewal
130
# Vault certificate auto-renewal
131
0 2 * * * root /usr/local/bin/vault-cert-manager.sh auto-renew >> /var/log/cert-renewal.log 2>&1
132
*/15 * * * * root /usr/local/bin/vault-cert-manager.sh monitor >> /var/log/cert-monitor.log 2>&1
133
EOF
134
}
135

136
# Main function
137
main() {
138
    case "${1:-help}" in
139
        request)
140
            request_certificate "$2" "$3" "$4"
141
            ;;
142
        check)
143
            check_certificate_expiry "$2" "$3"
144
            ;;
145
        auto-renew)
146
            auto_renew_certificates
147
            ;;
148
        monitor)
149
            monitor_certificates
150
            ;;
151
        setup-cron)
152
            setup_auto_renewal
153
            ;;
154
        help)
155
            echo "Usage: $0 {request|check|auto-renew|monitor|setup-cron}"
156
            echo "  request <common_name> <alt_names> <ttl>  - Request new certificate"
157
            echo "  check <cert_file> <days>                  - Check certificate expiry"
158
            echo "  auto-renew                                - Auto-renew expiring certificates"
159
            echo "  monitor                                   - Export metrics for monitoring"
160
            echo "  setup-cron                               - Setup automatic renewal"
161
            ;;
162
    esac
163
}
164

165
main "$@"

Service Discovery Integration#

Dynamic Service Registration#

1
#!/bin/bash
2
# vault-service-discovery.sh - Dynamic service registration with Vault
3

4
# Register service in Vault DNS
5
register_service() {
6
    local service_name=$1
7
    local service_ip=$2
8
    local service_port=$3
9
    local health_check=$4
10

11
    # Create A record for service
12
    vault kv put "dns/${service_name}.service.internal" \
13
        "A=${service_ip}" \
14
        "TXT=port=${service_port}" \
15
        "health_check=${health_check}" \
16
        "registered=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
17

18
    # Create SRV record
19
    vault kv put "dns/_${service_name}._tcp.service.internal" \
20
        "SRV=0 0 ${service_port} ${service_name}.service.internal." \
21
        "TTL=60"
22

23
    echo "Service registered: ${service_name} -> ${service_ip}:${service_port}"
24
}
25

26
# Deregister service
27
deregister_service() {
28
    local service_name=$1
29

30
    vault kv delete "dns/${service_name}.service.internal"
31
    vault kv delete "dns/_${service_name}._tcp.service.internal"
32

33
    echo "Service deregistered: ${service_name}"
34
}
35

36
# Health check monitor
37
monitor_service_health() {
38
    local check_interval=${1:-30}
39

40
    while true; do
41
        # List all services
42
        vault kv list -format=json dns/ | jq -r '.[]' | \
43
        grep -E '\.service\.internal$' | \
44
        while read -r service_record; do
45
            # Get service details
46
            service_data=$(vault kv get -format=json "dns/${service_record}")
47
            service_ip=$(echo "$service_data" | jq -r '.data.data.A')
48
            health_check=$(echo "$service_data" | jq -r '.data.data.health_check // ""')
49

50
            if [[ -n "$health_check" ]]; then
51
                # Perform health check
52
                if curl -sf "$health_check" > /dev/null; then
53
                    echo "✓ ${service_record} is healthy"
54
                else
55
                    echo "✗ ${service_record} is unhealthy"
56
                    # Could implement auto-deregistration or alerting here
57
                fi
58
            fi
59
        done
60

61
        sleep "$check_interval"
62
    done
63
}
64

65
# Kubernetes service sync
66
sync_kubernetes_services() {
67
    local namespace=${1:-default}
68

69
    echo "Syncing Kubernetes services from namespace: $namespace"
70

71
    # Get all services
72
    kubectl get services -n "$namespace" -o json | \
73
    jq -r '.items[] | select(.spec.type != "ClusterIP") |
74
        "\(.metadata.name) \(.status.loadBalancer.ingress[0].ip // .spec.clusterIP) \(.spec.ports[0].port)"' | \
75
    while read -r name ip port; do
76
        if [[ -n "$ip" ]] && [[ "$ip" != "null" ]]; then
77
            register_service "$name" "$ip" "$port" "http://${ip}:${port}/health"
78
        fi
79
    done
80
}

CoreDNS Plugin Enhancement#

Advanced Vault Plugin Features#

1
// vault_enhanced.go - Enhanced Vault plugin for CoreDNS
2

3
package vault
4

5
import (
6
    "context"
7
    "crypto/tls"
8
    "crypto/x509"
9
    "encoding/json"
10
    "fmt"
11
    "io/ioutil"
12
    "net"
13
    "sync"
14
    "time"
15

16
    "github.com/coredns/coredns/plugin"
17
    "github.com/coredns/coredns/plugin/metrics"
18
    "github.com/coredns/coredns/request"
19
    "github.com/hashicorp/vault/api"
20
    "github.com/miekg/dns"
21
    "github.com/prometheus/client_golang/prometheus"
22
)
23

24
// Metrics
25
var (
26
    vaultRequestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
27
        Namespace: "coredns",
28
        Subsystem: "vault",
29
        Name:      "requests_total",
30
        Help:      "Total number of requests to Vault.",
31
    }, []string{"status"})
32

33
    vaultLatency = prometheus.NewHistogramVec(prometheus.HistogramOpts{
34
        Namespace: "coredns",
35
        Subsystem: "vault",
36
        Name:      "request_duration_seconds",
37
        Help:      "Time taken to get response from Vault.",
38
        Buckets:   prometheus.DefBuckets,
39
    }, []string{"status"})
40
)
41

42
// EnhancedVault structure
43
type EnhancedVault struct {
44
    Next      plugin.Handler
45
    client    *api.Client
46
    paths     []string
47
    cache     *DNSCache
48
    tlsConfig *tls.Config
49

50
    // Authentication
51
    roleID    string
52
    secretID  string
53
    token     string
54
    tokenLock sync.RWMutex
55

56
    // Configuration
57
    ttl            uint32
58
    refreshPeriod  time.Duration
59
    cacheDuration  time.Duration
60
    maxRetries     int
61
}
62

63
// DNSCache for Vault responses
64
type DNSCache struct {
65
    sync.RWMutex
66
    entries map[string]*CacheEntry
67
}
68

69
type CacheEntry struct {
70
    Record    string
71
    Type      uint16
72
    ExpiresAt time.Time
73
}
74

75
// Initialize enhanced Vault plugin
76
func (v *EnhancedVault) initialize() error {
77
    // Setup Vault client
78
    config := api.DefaultConfig()
79
    config.Address = v.address
80

81
    if v.tlsConfig != nil {
82
        config.HttpClient.Transport = &http.Transport{
83
            TLSClientConfig: v.tlsConfig,
84
        }
85
    }
86

87
    client, err := api.NewClient(config)
88
    if err != nil {
89
        return err
90
    }
91

92
    v.client = client
93

94
    // Authenticate with AppRole
95
    if err := v.authenticate(); err != nil {
96
        return err
97
    }
98

99
    // Start token renewal
100
    go v.tokenRenewalLoop()
101

102
    // Start cache cleanup
103
    go v.cacheCleanupLoop()
104

105
    return nil
106
}
107

108
// Authenticate with Vault using AppRole
109
func (v *EnhancedVault) authenticate() error {
110
    data := map[string]interface{}{
111
        "role_id":   v.roleID,
112
        "secret_id": v.secretID,
113
    }
114

115
    resp, err := v.client.Logical().Write("auth/approle/login", data)
116
    if err != nil {
117
        return fmt.Errorf("failed to authenticate with Vault: %w", err)
118
    }
119

120
    v.tokenLock.Lock()
121
    v.token = resp.Auth.ClientToken
122
    v.client.SetToken(v.token)
123
    v.tokenLock.Unlock()
124

125
    return nil
126
}
127

128
// Token renewal loop
129
func (v *EnhancedVault) tokenRenewalLoop() {
130
    ticker := time.NewTicker(30 * time.Minute)
131
    defer ticker.Stop()
132

133
    for range ticker.C {
134
        v.tokenLock.RLock()
135
        token := v.token
136
        v.tokenLock.RUnlock()
137

138
        // Renew token
139
        resp, err := v.client.Auth().Token().RenewSelf(3600)
140
        if err != nil {
141
            // Re-authenticate if renewal fails
142
            if err := v.authenticate(); err != nil {
143
                log.Errorf("Failed to re-authenticate: %v", err)
144
            }
145
        }
146
    }
147
}
148

149
// Enhanced ServeDNS with caching and metrics
150
func (v *EnhancedVault) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
151
    state := request.Request{W: w, Req: r}
152
    qname := state.Name()
153
    qtype := state.QType()
154

155
    // Check cache first
156
    if cached := v.getFromCache(qname, qtype); cached != "" {
157
        return v.buildResponse(w, r, qname, qtype, cached)
158
    }
159

160
    // Measure Vault request time
161
    start := time.Now()
162

163
    // Try multiple paths
164
    var record string
165
    var err error
166

167
    for _, path := range v.paths {
168
        record, err = v.getRecordWithRetry(path, qname, qtype)
169
        if err == nil && record != "" {
170
            break
171
        }
172
    }
173

174
    // Record metrics
175
    duration := time.Since(start)
176
    if err != nil {
177
        vaultRequestCount.WithLabelValues("error").Inc()
178
        vaultLatency.WithLabelValues("error").Observe(duration.Seconds())
179
        return v.Next.ServeDNS(ctx, w, r)
180
    }
181

182
    vaultRequestCount.WithLabelValues("success").Inc()
183
    vaultLatency.WithLabelValues("success").Observe(duration.Seconds())
184

185
    // Cache the result
186
    v.addToCache(qname, qtype, record)
187

188
    return v.buildResponse(w, r, qname, qtype, record)
189
}
190

191
// Get record with retry logic
192
func (v *EnhancedVault) getRecordWithRetry(path, name string, qtype uint16) (string, error) {
193
    var lastErr error
194

195
    for i := 0; i < v.maxRetries; i++ {
196
        record, err := v.getRecord(path, name, qtype)
197
        if err == nil {
198
            return record, nil
199
        }
200

201
        lastErr = err
202

203
        // Exponential backoff
204
        time.Sleep(time.Duration(i*100) * time.Millisecond)
205
    }
206

207
    return "", lastErr
208
}
209

210
// Dynamic record updates
211
func (v *EnhancedVault) watchForUpdates() {
212
    ticker := time.NewTicker(v.refreshPeriod)
213
    defer ticker.Stop()
214

215
    for range ticker.C {
216
        // Clear cache to force refresh
217
        v.cache.Lock()
218
        v.cache.entries = make(map[string]*CacheEntry)
219
        v.cache.Unlock()
220
    }
221
}
222

223
// Prometheus metrics registration
224
func init() {
225
    prometheus.MustRegister(vaultRequestCount)
226
    prometheus.MustRegister(vaultLatency)
227
}

Monitoring and Observability#

Vault-CoreDNS Monitoring Stack#

1
version: "3.8"
2

3
services:
4
  prometheus:
5
    image: prom/prometheus:latest
6
    volumes:
7
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
8
      - prometheus-data:/prometheus
9
    ports:
10
      - "9090:9090"
11
    command:
12
      - "--config.file=/etc/prometheus/prometheus.yml"
13
      - "--storage.tsdb.path=/prometheus"
14

15
  grafana:
16
    image: grafana/grafana:latest
17
    volumes:
18
      - grafana-data:/var/lib/grafana
19
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards
20
      - ./grafana/datasources:/etc/grafana/provisioning/datasources
21
    ports:
22
      - "3000:3000"
23
    environment:
24
      - GF_SECURITY_ADMIN_PASSWORD=admin
25
      - GF_INSTALL_PLUGINS=grafana-clock-panel,grafana-simple-json-datasource
26

27
  vault-exporter:
28
    image: quay.io/coreos/vault-exporter:latest
29
    environment:
30
      - VAULT_ADDR=https://vault.example.com:8200
31
      - VAULT_TOKEN=${VAULT_TOKEN}
32
    ports:
33
      - "9410:9410"
34

35
  coredns-exporter:
36
    image: coredns/coredns:latest
37
    command: ["-dns.port=9153", "-conf", "/etc/coredns/Corefile.metrics"]
38
    volumes:
39
      - ./coredns-metrics.conf:/etc/coredns/Corefile.metrics
40
    ports:
41
      - "9153:9153"
42

43
volumes:
44
  prometheus-data:
45
  grafana-data:

Monitoring Configuration#

1
global:
2
  scrape_interval: 15s
3
  evaluation_interval: 15s
4

5
scrape_configs:
6
  - job_name: "vault"
7
    static_configs:
8
      - targets: ["vault-exporter:9410"]
9
    metric_relabel_configs:
10
      - source_labels: [__name__]
11
        regex: "go_.*"
12
        action: drop
13

14
  - job_name: "coredns"
15
    static_configs:
16
      - targets: ["coredns:9153"]
17

18
  - job_name: "node"
19
    static_configs:
20
      - targets: ["node-exporter:9100"]
21

22
# Alerting rules
23
rule_files:
24
  - "alerts/*.yml"
25

26
alerting:
27
  alertmanagers:
28
    - static_configs:
29
        - targets: ["alertmanager:9093"]

Alert Rules#

1
groups:
2
  - name: vault_dns_alerts
3
    rules:
4
      - alert: VaultDNSHighLatency
5
        expr: histogram_quantile(0.95, coredns_vault_request_duration_seconds_bucket) > 0.5
6
        for: 5m
7
        labels:
8
          severity: warning
9
        annotations:
10
          summary: "High Vault DNS lookup latency"
11
          description: "95th percentile latency is {{ $value }}s"
12

13
      - alert: VaultDNSErrors
14
        expr: rate(coredns_vault_requests_total{status="error"}[5m]) > 0.1
15
        for: 5m
16
        labels:
17
          severity: critical
18
        annotations:
19
          summary: "High Vault DNS error rate"
20
          description: "Error rate is {{ $value }} per second"
21

22
      - alert: CertificateExpiringSoon
23
        expr: cert_expiry_days < 30
24
        for: 1h
25
        labels:
26
          severity: warning
27
        annotations:
28
          summary: "Certificate expiring soon"
29
          description: "Certificate {{ $labels.name }} expires in {{ $value }} days"
30

31
      - alert: VaultSealed
32
        expr: vault_core_unsealed == 0
33
        for: 1m
34
        labels:
35
          severity: critical
36
        annotations:
37
          summary: "Vault is sealed"
38
          description: "Vault has been sealed and is not serving requests"

Security Best Practices#

Security Implementation#

1
graph TD
2
    A[Security Layers] --> B[Authentication]
3
    A --> C[Encryption]
4
    A --> D[Authorization]
5
    A --> E[Auditing]
6

7
    B --> F[AppRole Auth]
8
    B --> G[Token Renewal]
9
    B --> H[mTLS]
10

11
    C --> I[TLS 1.3]
12
    C --> J[Encrypted Storage]
13
    C --> K[Transit Encryption]
14

15
    D --> L[Vault Policies]
16
    D --> M[DNS ACLs]
17
    D --> N[Network Policies]
18

19
    E --> O[Vault Audit]
20
    E --> P[CoreDNS Logs]
21
    E --> Q[Access Logs]
22

23
    style A fill:#ff6b6b,stroke:#c92a2a,stroke-width:2px
24
    style C fill:#74c0fc,stroke:#1971c2,stroke-width:2px
25
    style E fill:#4ecdc4,stroke:#087f5b,stroke-width:2px

Security Configuration#

1
#!/bin/bash
2
# secure-vault-coredns.sh - Security hardening
3

4
# Enable Vault audit logging
5
enable_audit_logging() {
6
    vault audit enable file file_path=/vault/logs/audit.log
7
    vault audit enable syslog tag="vault" facility="LOCAL7"
8
}
9

10
# Configure strict policies
11
configure_security_policies() {
12
    # DNS read-only policy
13
    cat << 'EOF' | vault policy write dns-readonly -
14
path "dns/data/*" {
15
  capabilities = ["read", "list"]
16
}
17

18
path "dns/metadata/*" {
19
  capabilities = ["list"]
20
}
21

22
deny "dns/+/delete" {
23
  capabilities = ["deny"]
24
}
25
EOF
26

27
    # Certificate issuance policy
28
    cat << 'EOF' | vault policy write cert-issue -
29
path "pki_int/issue/dns-cert" {
30
  capabilities = ["create", "update"]
31
  allowed_parameters = {
32
    "common_name" = ["*.example.com", "*.internal.local"]
33
    "ttl" = ["1h", "24h", "720h"]
34
  }
35
}
36
EOF
37
}
38

39
# Setup network security
40
configure_network_security() {
41
    # Firewall rules
42
    sudo ufw allow from 10.0.0.0/8 to any port 8200
43
    sudo ufw allow from 172.16.0.0/12 to any port 8200
44
    sudo ufw allow from 192.168.0.0/16 to any port 8200
45
    sudo ufw deny 8200
46

47
    # IP tables rate limiting
48
    sudo iptables -A INPUT -p tcp --dport 8200 -m connlimit --connlimit-above 50 -j REJECT
49
    sudo iptables -A INPUT -p tcp --dport 53 -m connlimit --connlimit-above 100 -j REJECT
50
}
51

52
# Enable mTLS
53
setup_mtls() {
54
    # Generate client certificates
55
    vault write pki_int/issue/client-cert \
56
        common_name="coredns-client" \
57
        ttl="8760h" \
58
        -format=json > coredns-client.json
59

60
    # Extract certificates
61
    jq -r '.data.certificate' coredns-client.json > /etc/coredns/client.crt
62
    jq -r '.data.private_key' coredns-client.json > /etc/coredns/client.key
63
    jq -r '.data.ca_chain[]' coredns-client.json > /etc/coredns/ca.crt
64

65
    # Configure Vault to require client certs
66
    cat << 'EOF' >> /etc/vault.d/vault.hcl
67
listener "tcp" {
68
  address       = "0.0.0.0:8200"
69
  tls_cert_file = "/opt/vault/tls/vault.crt"
70
  tls_key_file  = "/opt/vault/tls/vault.key"
71
  tls_require_and_verify_client_cert = true
72
  tls_client_ca_file = "/opt/vault/tls/ca.crt"
73
}
74
EOF
75
}

Production Deployment#

High Availability Setup#

1
#!/bin/bash
2
# ha-deployment.sh - Deploy Vault and CoreDNS in HA mode
3

4
# Deploy Vault cluster
5
deploy_vault_cluster() {
6
    # Node 1
7
    vault operator raft join https://vault-1.example.com:8200
8

9
    # Node 2
10
    vault operator raft join https://vault-2.example.com:8200
11

12
    # Node 3
13
    vault operator raft join https://vault-3.example.com:8200
14

15
    # List peers
16
    vault operator raft list-peers
17
}
18

19
# Deploy CoreDNS cluster
20
deploy_coredns_cluster() {
21
    # Create CoreDNS configuration for clustering
22
    cat << 'EOF' > /etc/coredns/Corefile.ha
23
.:53 {
24
    vault {
25
        address https://vault.example.com:8200
26
        token env:VAULT_TOKEN
27
        path dns
28
        ttl 300
29
    }
30

31
    # Health check for load balancer
32
    health {
33
        lameduck 5s
34
    }
35

36
    # Ready endpoint
37
    ready
38

39
    # Prometheus metrics
40
    prometheus :9153
41

42
    # Forward to other CoreDNS instances
43
    forward . dns-1.example.com:53 dns-2.example.com:53 dns-3.example.com:53 {
44
        policy round_robin
45
        health_check 5s
46
    }
47

48
    cache 30
49
    log
50
}
51
EOF
52

53
    # Deploy with systemd
54
    systemctl enable coredns
55
    systemctl start coredns
56
}
57

58
# Setup load balancing
59
setup_load_balancer() {
60
    # HAProxy configuration
61
    cat << 'EOF' > /etc/haproxy/haproxy.cfg
62
global
63
    maxconn 4096
64
    log 127.0.0.1 local0
65

66
defaults
67
    mode tcp
68
    timeout connect 5s
69
    timeout client 30s
70
    timeout server 30s
71

72
frontend dns_frontend
73
    bind *:53
74
    default_backend dns_backend
75

76
backend dns_backend
77
    balance roundrobin
78
    server dns1 dns-1.example.com:53 check
79
    server dns2 dns-2.example.com:53 check
80
    server dns3 dns-3.example.com:53 check
81

82
frontend vault_frontend
83
    bind *:8200 ssl crt /etc/ssl/vault.pem
84
    default_backend vault_backend
85

86
backend vault_backend
87
    balance roundrobin
88
    option httpchk GET /v1/sys/health
89
    server vault1 vault-1.example.com:8200 check ssl verify none
90
    server vault2 vault-2.example.com:8200 check ssl verify none
91
    server vault3 vault-3.example.com:8200 check ssl verify none
92
EOF
93
}

Conclusion#

Integrating HashiCorp Vault with CoreDNS provides:

Secure DNS Management: Centralized, encrypted storage of DNS records
Dynamic Updates: API-driven DNS record management
Certificate Automation: Automatic certificate issuance and renewal
Service Discovery: Dynamic service registration and health checking
Security: mTLS, audit logging, and policy-based access control
High Availability: Clustered deployment for production use

Key benefits achieved:

Eliminated static DNS configuration files
Automated certificate lifecycle management
Centralized secrets and DNS management
Enhanced security with encryption at rest and in transit
Dynamic service discovery capabilities
Complete audit trail for compliance

This integration creates a robust, secure, and scalable DNS infrastructure suitable for modern cloud-native environments.