From 4163bf80b36242a7c3b47195743d3d29df3ab829 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Wed, 15 Jul 2026 07:45:59 +1000
Subject: [PATCH] Add identity.unkin.net internal DNS record

identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS
record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to
resolve it. Add an authoritative A record via the bind-operator so the
internal bind system serves it.

- New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP,
  where the authentik Gateway serves the identity.unkin.net hostname).
- Placed in the bind-internal namespace alongside the unkin-net BindZone: the
  operator resolves zoneRef/clusterRef/updateKeyRef within the record's own
  namespace, so it cannot live in the app namespace.
- "internal" in the name distinguishes it from the external DNS Authentik will
  manage its own records from later.
---
 .../authoritative/kustomization.yaml          |  1 +
 .../bind-internal/authoritative/records.yaml  | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 apps/base/bind-internal/authoritative/records.yaml

diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml
index 2116a01..2e56dd4 100644
--- a/apps/base/bind-internal/authoritative/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/kustomization.yaml
@@ -6,4 +6,5 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - records.yaml
   - acls.yaml
diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
new file mode 100644
index 0000000..d4bb741
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -0,0 +1,21 @@
+# Individually-managed authoritative records for the unkin.net zone.
+# DNSRecords must live in the same namespace as their BindZone (the operator
+# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
+# these sit alongside the zone in bind-internal, not in the app namespace.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  # "internal" in the name distinguishes this from the external DNS that
+  # Authentik will manage its own records from later.
+  name: identity-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: identity
+  type: A
+  ttl: 600
+  values:
+    # traefik-internal gateway VIP; the authentik Gateway serves the
+    # identity.unkin.net hostname there.
+    - 198.18.200.4