From 0c1156282fbf3c1d635a5c0de18c97184cde558b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 19 Jul 2026 00:10:56 +1000 Subject: [PATCH] bind-internal: allow localhost to query the authoritative cluster (#267) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Every bind-operator dynamic update is refused (`update ... denied due to allow-query`) because the operator execs `nsupdate` against `127.0.0.1` inside the primary pod, and the BindCluster `allow-query` listed only the client subnets (`auth-acl-main`) and the pod net (`10.42.0.0/16`) — not loopback. This blocked ALL DNSRecords (identity, s3, dashboard, lb1) from ever applying. ## Change - Add `localhost` to the BindCluster `allow-query` in `apps/base/bind-internal/authoritative/cluster.yaml`. The `client-update` TSIG key still gates the actual update. --------- Co-authored-by: benvin Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/267 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/bind-internal/authoritative/cluster.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml index 3096cbd..de2a627 100644 --- a/apps/base/bind-internal/authoritative/cluster.yaml +++ b/apps/base/bind-internal/authoritative/cluster.yaml @@ -13,9 +13,11 @@ spec: storageSize: 2Gi # Restrict queries to internal networks (puppet acl-main.unkin.net). # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh - # from the primary during catalog replication. + # from the primary during catalog replication. localhost is required so the + # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization; + # without it every dynamic update is "denied due to allow-query". extraOptions: - - "allow-query { auth-acl-main; 10.42.0.0/16; }" + - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }" service: type: LoadBalancer externalTrafficPolicy: Local