brew install stubby jq yq

vi /opt/homebrew/etc/stubby/stubby.yml

sudo brew services start stubby
sudo brew services stop stubby

sudo stubby -l &
sudo kill $(pidof stubby)

sudo lsof -i :53

DNS=127.0.0.1
DEFAULT_IFACE=$(route -n get default | awk '/interface: / {print $2}')
INTERFACE=$(networksetup -listnetworkserviceorder | grep -B 1 "Device: $DEFAULT_IFACE" | head -n 1 | sed 's/.*) //')
if [ -z "$INTERFACE" ]; then
    echo "활성 네트워크 서비스를 찾을 수 없습니다."
else
    sudo networksetup -setdnsservers "$INTERFACE" $DNS
    echo "성공: [$INTERFACE]의 DNS를 ${DNS}로 설정했습니다."
fi

domain=hanacloudia.com
sudo mkdir -p /etc/resolver
cat <<EOF | sudo tee /etc/resolver/$domain
nameserver 127.0.0.1
EOF
scutil --dns

dns_domain=dns.okestro.hanacloudia.com
dns_ip=10.255.57.88
cafile=~/Downloads/ca.crt
cp $cafile /opt/homebrew/etc/stubby/ca.crt

export upstream_recursive_servers=$(cat << EOF | yq -pyaml -ojson | jq '.temps'
temps:
  - address_data: $dns_ip
    tls_auth_name: "$dns_domain"
    tls_port: 853
    tls_ca_file: "./ca.crt"
EOF
)
yq -i ".upstream_recursive_servers = $upstream_recursive_servers" \
  /opt/homebrew/etc/stubby/stubby.yml

sudo brew services restart stubby

#dns소속 k8s에서
pubkey_sha256=$(kubectl get secret -n management-system dns.okestro.hanacloudia.com-tls -o=jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64)

dns_domain=dns.okestro.hanacloudia.com
dns_ip=10.255.57.88
cafile=~/Downloads/ca.crt
cp $cafile /opt/homebrew/etc/stubby/ca.crt

export upstream_recursive_servers=$(cat << EOF | yq -pyaml -ojson | jq '.temps'
temps:
  - address_data: $dns_ip
    tls_auth_name: "$dns_domain"
    tls_port: 853
    tls_pubkey_pinset:
      - digest: "sha256"
        value: "$pubkey_sha256"
EOF
)
yq -i ".upstream_recursive_servers = $upstream_recursive_servers" \
  /opt/homebrew/etc/stubby/stubby.yml

sudo brew services restart stubby

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder