From 7581578df1e5327105ec56b69fed7b174d79f170 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 17:28:37 +1000 Subject: [PATCH] Split bind-external DNSRecords into one file per record (#500) A single records.yaml holding every DNSRecord means any record change touches a shared file, and deleting one record is a hunk edit rather than a file removal. One file per record under //.yaml makes each record independently editable and removable. - move acme-apex-ns to acme-unkin-net/ns/apex.yaml and acme-ns1-a to acme-unkin-net/a/ns1.yaml - add kustomization.yaml per zone and type directory, referencing directories from the parent - carry the delegation rationale onto the zone kustomization - drop records.yaml and reference the zone directory from the app kustomization Rendered output is unchanged. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/500 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../acme-unkin-net/a/kustomization.yaml | 6 ++++ .../bind-external/acme-unkin-net/a/ns1.yaml | 16 +++++++++ .../acme-unkin-net/kustomization.yaml | 11 ++++++ .../bind-external/acme-unkin-net/ns/apex.yaml | 16 +++++++++ .../acme-unkin-net/ns/kustomization.yaml | 6 ++++ apps/base/bind-external/kustomization.yaml | 2 +- apps/base/bind-external/records.yaml | 36 ------------------- 7 files changed, 56 insertions(+), 37 deletions(-) create mode 100644 apps/base/bind-external/acme-unkin-net/a/kustomization.yaml create mode 100644 apps/base/bind-external/acme-unkin-net/a/ns1.yaml create mode 100644 apps/base/bind-external/acme-unkin-net/kustomization.yaml create mode 100644 apps/base/bind-external/acme-unkin-net/ns/apex.yaml create mode 100644 apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml delete mode 100644 apps/base/bind-external/records.yaml diff --git a/apps/base/bind-external/acme-unkin-net/a/kustomization.yaml b/apps/base/bind-external/acme-unkin-net/a/kustomization.yaml new file mode 100644 index 0000000..7a77468 --- /dev/null +++ b/apps/base/bind-external/acme-unkin-net/a/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns1.yaml diff --git a/apps/base/bind-external/acme-unkin-net/a/ns1.yaml b/apps/base/bind-external/acme-unkin-net/a/ns1.yaml new file mode 100644 index 0000000..628f4c1 --- /dev/null +++ b/apps/base/bind-external/acme-unkin-net/a/ns1.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: acme-ns1-a + namespace: bind-external +spec: + zoneRef: acme-unkin-net + name: ns1 + type: A + ttl: 3600 + values: + # Public address of this cluster's external BIND, same target as + # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net + # NS name must still reach the zone. + - 103.216.191.185 diff --git a/apps/base/bind-external/acme-unkin-net/kustomization.yaml b/apps/base/bind-external/acme-unkin-net/kustomization.yaml new file mode 100644 index 0000000..1ee0cfc --- /dev/null +++ b/apps/base/bind-external/acme-unkin-net/kustomization.yaml @@ -0,0 +1,11 @@ +--- +# Authoritative delegation records for acme.unkin.net. Without these the zone +# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the +# primary pod IP), which is unroutable off-cluster and goes stale on +# reschedule. DNSRecords must live in the same namespace as their BindZone. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns + - a diff --git a/apps/base/bind-external/acme-unkin-net/ns/apex.yaml b/apps/base/bind-external/acme-unkin-net/ns/apex.yaml new file mode 100644 index 0000000..245ab17 --- /dev/null +++ b/apps/base/bind-external/acme-unkin-net/ns/apex.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: acme-apex-ns + namespace: bind-external +spec: + zoneRef: acme-unkin-net + # "@" is the zone apex. + name: "@" + type: NS + ttl: 3600 + values: + # Matches the parent delegation in Google Cloud DNS. Out of zone, so the + # child needs no glue of its own. + - acme-ns1.unkin.net. diff --git a/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml b/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml new file mode 100644 index 0000000..7a02b57 --- /dev/null +++ b/apps/base/bind-external/acme-unkin-net/ns/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - apex.yaml diff --git a/apps/base/bind-external/kustomization.yaml b/apps/base/bind-external/kustomization.yaml index 6d73342..548c5ed 100644 --- a/apps/base/bind-external/kustomization.yaml +++ b/apps/base/bind-external/kustomization.yaml @@ -7,5 +7,5 @@ resources: - cluster.yaml - tsigkey.yaml - zones.yaml - - records.yaml + - acme-unkin-net - agent-dns-rolebinding.yaml diff --git a/apps/base/bind-external/records.yaml b/apps/base/bind-external/records.yaml deleted file mode 100644 index d37c45d..0000000 --- a/apps/base/bind-external/records.yaml +++ /dev/null @@ -1,36 +0,0 @@ -# Authoritative delegation records for acme.unkin.net. Without these the zone -# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the -# primary pod IP), which is unroutable off-cluster and goes stale on -# reschedule. DNSRecords must live in the same namespace as their BindZone. ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: acme-apex-ns - namespace: bind-external -spec: - zoneRef: acme-unkin-net - # "@" is the zone apex. - name: "@" - type: NS - ttl: 3600 - values: - # Matches the parent delegation in Google Cloud DNS. Out of zone, so the - # child needs no glue of its own. - - acme-ns1.unkin.net. ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: acme-ns1-a - namespace: bind-external -spec: - zoneRef: acme-unkin-net - name: ns1 - type: A - ttl: 3600 - values: - # Public address of this cluster's external BIND, same target as - # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net - # NS name must still reach the zone. - - 103.216.191.185