From 4cdf9cef37b1c07b7d83698921533573fb7cefd4 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 4 Jul 2026 23:16:20 +1000
Subject: [PATCH] Add primary (write) Services to the authoritative +
 externaldns clusters

Writes (RFC2136/nsupdate) must hit pod-0; the round-robin read Service
would land them on a secondary. Add a dedicated write endpoint per
cluster (operator v0.1.5 primaryService field).

- bind-authoritative: LoadBalancer write endpoint on 198.18.200.9
- bind-externaldns: ClusterIP write endpoint (in-cluster writers)
- regenerate bindcluster kubeconform schema (primaryService +
  externalTrafficPolicy)

external-dns is NOT yet repointed at bind-externaldns-primary: it
authenticates with the existing key, which the operator-generated key
doesn't match until the planned Vault-sync / secret-reflection features
land.
---
 .../bind-internal/authoritative/cluster.yaml  |  6 ++++
 .../bind-internal/externaldns/cluster.yaml    |  2 ++
 .../bind.unkin.net/bindcluster_v1alpha1.json  | 36 +++++++++++++++++++
 3 files changed, 44 insertions(+)

diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml
index 6afd4e2..639d780 100644
--- a/apps/base/bind-internal/authoritative/cluster.yaml
+++ b/apps/base/bind-internal/authoritative/cluster.yaml
@@ -23,6 +23,12 @@ spec:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.6
       external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
+  primaryService:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.9
+      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
   resources:
     requests:
       cpu: 100m
diff --git a/apps/base/bind-internal/externaldns/cluster.yaml b/apps/base/bind-internal/externaldns/cluster.yaml
index 376082e..5b2a0ca 100644
--- a/apps/base/bind-internal/externaldns/cluster.yaml
+++ b/apps/base/bind-internal/externaldns/cluster.yaml
@@ -19,6 +19,8 @@ spec:
       purelb.io/service-group: common
       purelb.io/addresses: 198.18.200.8
       external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
+  primaryService:
+    type: ClusterIP
   resources:
     requests:
       cpu: 100m
diff --git a/schemas/bind.unkin.net/bindcluster_v1alpha1.json b/schemas/bind.unkin.net/bindcluster_v1alpha1.json
index 1aaa072..abecc82 100644
--- a/schemas/bind.unkin.net/bindcluster_v1alpha1.json
+++ b/schemas/bind.unkin.net/bindcluster_v1alpha1.json
@@ -692,6 +692,35 @@
           },
           "type": "object"
         },
+        "primaryService": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
+            "loadBalancerIP": {
+              "type": "string"
+            },
+            "type": {
+              "enum": [
+                "ClusterIP",
+                "LoadBalancer",
+                "NodePort"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
         "recursion": {
           "type": "boolean"
         },
@@ -765,6 +794,13 @@
               },
               "type": "object"
             },
+            "externalTrafficPolicy": {
+              "enum": [
+                "Cluster",
+                "Local"
+              ],
+              "type": "string"
+            },
             "loadBalancerIP": {
               "type": "string"
             },