From 1f22ec2aa7ebf8a0bbce18673d06d194fbc8684b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 12 Jul 2026 22:52:19 +1000 Subject: [PATCH] Bump bind-operator to v0.2.2 (config-hash rolling restart) (#254) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why v0.2.2 (bind-operator #10) stamps a `bind.unkin.net/config-hash` on the pod template, so a ConfigMap or `keys.conf` change flips the hash and triggers an operator-driven rolling restart. This fixes the class of bug where config edits (ACLs, forwarders, `validate-except`, primary address, TSIG rotation) never reached running pods — they held a startup snapshot and needed manual pod deletes. ## Changes - Bump the operator image (`bind-system/deployment.yaml`) and the pulled CRD bundle URL (`bind-system/kustomization.yaml`) to `v0.2.2`. - Bump the `bind-tsig-api` image (`bind-internal/tsig-api/tsig-api.yaml`) to `v0.2.2`. CRDs are unchanged from v0.2.1 (controller-only change), so the generated kubeconform schemas need no update. ## Validation - `bind-system` renders with the v0.2.2 CRD bundle; pre-commit clean. ## Deploy note When the v0.2.2 operator first reconciles it stamps the config-hash annotation, triggering **one rolling restart per bind StatefulSet** — expected, and it also pulls in any already-pending config. From then on, config changes roll pods automatically. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/254 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/bind-internal/tsig-api/tsig-api.yaml | 2 +- apps/base/bind-system/deployment.yaml | 2 +- apps/base/bind-system/kustomization.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/apps/base/bind-internal/tsig-api/tsig-api.yaml b/apps/base/bind-internal/tsig-api/tsig-api.yaml index 47be244..0cdf3d4 100644 --- a/apps/base/bind-internal/tsig-api/tsig-api.yaml +++ b/apps/base/bind-internal/tsig-api/tsig-api.yaml @@ -13,7 +13,7 @@ metadata: name: bind-tsig-api namespace: bind-internal spec: - image: git.unkin.net/unkin/bind-tsig-api:v0.2.1 + image: git.unkin.net/unkin/bind-tsig-api:v0.2.2 replicas: 1 port: 8443 # targetNamespace defaults to this resource's namespace (bind-internal), where diff --git a/apps/base/bind-system/deployment.yaml b/apps/base/bind-system/deployment.yaml index acdd578..c68486c 100644 --- a/apps/base/bind-system/deployment.yaml +++ b/apps/base/bind-system/deployment.yaml @@ -21,7 +21,7 @@ spec: runAsNonRoot: true containers: - name: operator - image: git.unkin.net/unkin/bind-operator:v0.2.1 + image: git.unkin.net/unkin/bind-operator:v0.2.2 args: - --metrics-bind-address=:8080 - --health-probe-bind-address=:8081 diff --git a/apps/base/bind-system/kustomization.yaml b/apps/base/bind-system/kustomization.yaml index 4a31658..e18accb 100644 --- a/apps/base/bind-system/kustomization.yaml +++ b/apps/base/bind-system/kustomization.yaml @@ -6,6 +6,6 @@ resources: - namespace.yaml # CRDs are pulled from the bind-operator repo at the matching tag rather than # vendored here, so they never drift from the operator. - - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.1/config/crd/install.yaml + - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.2/config/crd/install.yaml - rbac.yaml - deployment.yaml