From 69788a967c51d7d53fc5b26632f053ca9de94d0b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 12 Jul 2026 22:26:23 +1000 Subject: [PATCH] Fix validate-except syntax (resolver crash-loop) (#252) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why — urgent PR #251 added `validate-except` to the resolver `BindCluster` but the list omitted the trailing semicolon after the final entry. `named` requires **every** entry in a list to be semicolon-terminated, including the last before the closing brace, so it fails config parse and the resolver pods crash-loop: ``` /run/named/named.conf:18: missing ';' before '}' loading configuration: failure exiting (due to fatal error) ``` The resolvers (`.7`) are down until this lands; the authoritative (`.6`/`.9`) and externaldns (`.8`) are unaffected. ## Fix ```diff - validate-except { unkin.net; 18.198.in-addr.arpa; consul } + validate-except { unkin.net; 18.198.in-addr.arpa; consul; } ``` Renders to `validate-except { unkin.net; 18.198.in-addr.arpa; consul; };` — valid. ## Recovery On merge + ArgoCD sync, the operator re-renders the ConfigMap with valid config and the crash-looping pods self-heal on their next restart (no manual `rollout restart` needed). Validated: `bind-internal` renders and pre-commit clean. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/252 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/bind-internal/resolvers/cluster.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index 2fc2888..161a7bd 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -29,7 +29,7 @@ spec: # insecure so they are not validated. unkin.net covers all *.unkin.net # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone. extraOptions: - - "validate-except { unkin.net; 18.198.in-addr.arpa; consul }" + - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }" resources: requests: cpu: 20m