From 421df740eaeb3a03d6dc50779265b381174cb6bd Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 15 Jul 2026 20:53:39 +1000 Subject: [PATCH] Add identity.unkin.net internal DNS record (#256) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why `identity.unkin.net` is configured as the Authentik OIDC issuer but has **no DNS record anywhere**, so in-cluster OIDC discovery fails (e.g. `argocd-server` → `lookup identity.unkin.net ... no such host`). Add an authoritative A record served by the internal bind system (bind-operator) so it resolves. ## Change - New `DNSRecord/identity-dns-internal` → `198.18.200.4` (the traefik-internal gateway VIP, where the Authentik Gateway serves the `identity.unkin.net` hostname), in the `unkin-net` zone. - Lives in the **`bind-internal` namespace** alongside the `BindZone`: the operator resolves `zoneRef`/`clusterRef`/`updateKeyRef` within the record's own namespace, so it can't live in the app (authentik) namespace. - Wired into `apps/base/bind-internal/authoritative/kustomization.yaml`. - `identity-dns-internal` name distinguishes this from the external DNS that Authentik will manage its own records from later. ## Validation `kustomize build apps/base/bind-internal` + kubeconform (validates against the `dnsrecord_v1alpha1` schema): 57 valid, 0 invalid. pre-commit clean. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/256 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../authoritative/kustomization.yaml | 1 + .../bind-internal/authoritative/records.yaml | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+) create mode 100644 apps/base/bind-internal/authoritative/records.yaml diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml index 2116a01..2e56dd4 100644 --- a/apps/base/bind-internal/authoritative/kustomization.yaml +++ b/apps/base/bind-internal/authoritative/kustomization.yaml @@ -6,4 +6,5 @@ resources: - cluster.yaml - tsigkey.yaml - zones.yaml + - records.yaml - acls.yaml diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml new file mode 100644 index 0000000..d4bb741 --- /dev/null +++ b/apps/base/bind-internal/authoritative/records.yaml @@ -0,0 +1,21 @@ +# Individually-managed authoritative records for the unkin.net zone. +# DNSRecords must live in the same namespace as their BindZone (the operator +# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so +# these sit alongside the zone in bind-internal, not in the app namespace. +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + # "internal" in the name distinguishes this from the external DNS that + # Authentik will manage its own records from later. + name: identity-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: identity + type: A + ttl: 600 + values: + # traefik-internal gateway VIP; the authentik Gateway serves the + # identity.unkin.net hostname there. + - 198.18.200.4