Add identity.unkin.net internal DNS record (#256)

## Why

`identity.unkin.net` is configured as the Authentik OIDC issuer but has **no DNS record anywhere**, so in-cluster OIDC discovery fails (e.g. `argocd-server` → `lookup identity.unkin.net ... no such host`). Add an authoritative A record served by the internal bind system (bind-operator) so it resolves.

## Change

- New `DNSRecord/identity-dns-internal` → `198.18.200.4` (the traefik-internal gateway VIP, where the Authentik Gateway serves the `identity.unkin.net` hostname), in the `unkin-net` zone.
- Lives in the **`bind-internal` namespace** alongside the `BindZone`: the operator resolves `zoneRef`/`clusterRef`/`updateKeyRef` within the record's own namespace, so it can't live in the app (authentik) namespace.
- Wired into `apps/base/bind-internal/authoritative/kustomization.yaml`.
- `identity-dns-internal` name distinguishes this from the external DNS that Authentik will manage its own records from later.

## Validation

`kustomize build apps/base/bind-internal` + kubeconform (validates against the `dnsrecord_v1alpha1` schema): 57 valid, 0 invalid. pre-commit clean.

Reviewed-on: #256
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #256.

This commit is contained in:

Ben Vincent

2026-07-15 20:53:39 +10:00

committed by

BenVincent

parent 8a9cdf35fd

commit 421df740ea

2 changed files with 22 additions and 0 deletions

									
										apps/base/bind-internal/authoritative/kustomization.yaml
									
		+1
		
												View File
												
				@@ -6,4 +6,5 @@ resources:

				  - cluster.yaml

				  - tsigkey.yaml

				  - zones.yaml

				  - records.yaml

				  - acls.yaml