---
# Authoritative masters (replaces the 3x Puppet authoritative servers).
# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
apiVersion: bind.unkin.net/v1alpha1
kind: BindCluster
metadata:
  name: bind-authoritative
  namespace: bind-internal
spec:
  mode: authoritative
  replicas: 3
  storageClassName: cephrbd-fast-delete
  storageSize: 2Gi
  # Restrict queries to internal networks (puppet acl-main.unkin.net).
  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
  # from the primary during catalog replication. localhost is required so the
  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
  # without it every dynamic update is "denied due to allow-query".
  extraOptions:
    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
    # Enable query logging for the Tier-2 vector bind_query pipeline (see the
    # resolvers cluster for the routing rationale).
    - "querylog yes"
  service:
    type: LoadBalancer
    externalTrafficPolicy: Local
    annotations:
      purelb.io/service-group: common
      purelb.io/addresses: 198.18.200.6
      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
  primaryService:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: common
      purelb.io/addresses: 198.18.200.9
      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
  resources:
    requests:
      cpu: 20m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 512Mi
---
# Catalog zone so new BindZones auto-provision onto the secondaries.
apiVersion: bind.unkin.net/v1alpha1
kind: BindCatalogZone
metadata:
  name: bind-authoritative-catalog
  namespace: bind-internal
spec:
  clusterRef: bind-authoritative
  zoneName: catalog.internal
  transferKeyRef: transfer-key
