go-dns VS ziti-gitlab-webhook

And this is the relevant bit: it lets you customize the dialing bit. github.com/ncruces/go-dns "hijacks" this mechanism to do its thing. It's a bit of an "hack", but an explicitly supported one.

For the record, I'm (also) interested because in github.com/ncruces/go-dns I do none of this.

Thus for your use case, you could use zrok out of the box (self-hosted or the SaaS), or alternatively you could use OpenZiti and utilise SDKs embedded in runners - e.g., we connect our Jenkins to Github with no inbound ports (https://netfoundry.io/this-is-the-way-invisible-jenkins/) or our Mattermost to a Lambda function which scans the internet, again, with no inbound ports (https://openziti.io/my-intern-assignment-call-a-dark-webhook-from-aws-lambda). Note, we have a zitified webhook for Gitlab too (https://github.com/openziti/ziti-gitlab-webhook).

You could also use OpenZiti, its an open source project which implements zero trust networking (incl. mTLS). We put our NodeJS SDK inside the Gitlab webhook - https://github.com/openziti/ziti-gitlab-webhook.

I would say the most secure way is to use a zero trust webhook from Gitlab to your EKS cluster. The open source project I work on created this and you can stand it up yourself - https://github.com/openziti/ziti-gitlab-webhook. We use this approach ourselves to connect our Jenkins to Github (https://netfoundry.io/this-is-the-way-invisible-jenkins/) as well as some AWS Lambdas to our Mattermost server (https://openziti.io/my-intern-assignment-call-a-dark-webhook-from-aws-lambda) while having no inbound ports or VPNs.

Pull data/webhooks from Github into a private app non-accessible to public internet - https://github.com/openziti/ziti-gitlab-webhook

Node, Webhook and GitHub/GitLab: https://github.com/openziti/ziti-gitlab-webhook