From 05d2c8325835cd3aa01ebed488f6498d60fb1413 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 11 Jul 2026 00:57:52 +1000 Subject: [PATCH] Authoritative zones: accept puppet client dynamic updates (#244) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enables per-host RFC2136 updates from puppet (puppet-prod #475 profiles::dns::updater) to the bind-authoritative zones, via the .9 write endpoint. ## Changes - add **client-update** BindTSIGKey (clusterRef bind-authoritative; operator generates the material into Secret client-update-tsig) - set `dynamicUpdate: true` + `updateKeyRef: client-update` on all **18** authoritative zones → the operator renders `allow-update { key "client-update"; }` ## Key bridge (manual, per the TSIG plan) The operator generates the client-update key value; it must reach puppet eyaml (`profiles::dns::updater::key_secret`) for clients to authenticate — until the planned Vault-sync/secret-reflection operator features exist. Get it with: `kubectl -n bind-internal get secret client-update-tsig -o jsonpath='{.data.secret}' | base64 -d` ## Validated kustomize build + kubeconform. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/244 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../bind-internal/authoritative/tsigkey.yaml | 13 +++++++ .../bind-internal/authoritative/zones.yaml | 36 +++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/apps/base/bind-internal/authoritative/tsigkey.yaml b/apps/base/bind-internal/authoritative/tsigkey.yaml index dc9b119..6de3e2d 100644 --- a/apps/base/bind-internal/authoritative/tsigkey.yaml +++ b/apps/base/bind-internal/authoritative/tsigkey.yaml @@ -9,3 +9,16 @@ metadata: spec: clusterRef: bind-authoritative algorithm: hmac-sha256 +--- +# Client-update key: puppet clients (profiles::dns::updater) nsupdate their own +# records to the authoritative zones with this key. Operator generates the +# material into Secret client-update-tsig; the same value must reach puppet +# eyaml (or the planned Vault-sync bridge) for clients to authenticate. +apiVersion: bind.unkin.net/v1alpha1 +kind: BindTSIGKey +metadata: + name: client-update + namespace: bind-internal +spec: + clusterRef: bind-authoritative + algorithm: hmac-sha256 diff --git a/apps/base/bind-internal/authoritative/zones.yaml b/apps/base/bind-internal/authoritative/zones.yaml index 53b8743..5e19686 100644 --- a/apps/base/bind-internal/authoritative/zones.yaml +++ b/apps/base/bind-internal/authoritative/zones.yaml @@ -15,6 +15,8 @@ spec: zoneName: unkin.net type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -26,6 +28,8 @@ spec: zoneName: main.unkin.net type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -37,6 +41,8 @@ spec: zoneName: 13.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -48,6 +54,8 @@ spec: zoneName: 14.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -59,6 +67,8 @@ spec: zoneName: 15.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -70,6 +80,8 @@ spec: zoneName: 16.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -81,6 +93,8 @@ spec: zoneName: 17.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -92,6 +106,8 @@ spec: zoneName: 19.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -103,6 +119,8 @@ spec: zoneName: 20.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -114,6 +132,8 @@ spec: zoneName: 21.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -125,6 +145,8 @@ spec: zoneName: 22.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -136,6 +158,8 @@ spec: zoneName: 23.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -147,6 +171,8 @@ spec: zoneName: 24.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -158,6 +184,8 @@ spec: zoneName: 25.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -169,6 +197,8 @@ spec: zoneName: 26.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -180,6 +210,8 @@ spec: zoneName: 27.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -191,6 +223,8 @@ spec: zoneName: 28.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone @@ -202,3 +236,5 @@ spec: zoneName: 29.18.198.in-addr.arpa type: primary defaultTTL: 600 + dynamicUpdate: true + updateKeyRef: client-update