From 7a889ca326c0a189e60807fe5b8182555c9d3d0b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 23:08:22 +1000 Subject: [PATCH] Flip resolver forwarding for k8s zones to the in-cluster bind (#288) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Step 3 of 3 in the external-dns → in-cluster bind migration: the client-visible cutover. The `openforwarder` resolvers currently forward `k8s.syd1.au.unkin.net` to the legacy VM anycast `198.18.19.20` (a temporary measure — commit 7ee5dfb) and have NO forwarder at all for the reverse zone `200.18.198.in-addr.arpa`. Once external-dns publishes to the in-cluster `bind-externaldns` (PR 2), resolvers must read from it. ## Changes - Repoints the `fwd-k8s-syd1-au-unkin-net` forwarder from `198.18.19.20` (legacy VM) to `198.18.200.8` (in-cluster `bind-externaldns` VIP). - Adds `fwd-200-18-198-in-addr-arpa` forwarding `200.18.198.in-addr.arpa` → `198.18.200.8`, closing the reverse-zone gap so PTR lookups for the k8s LB range keep resolving after cutover. Modeled exactly on the existing forward-zone entries. - Refreshes the header comment to describe the in-cluster upstream. `kubectl kustomize apps/overlays/au-syd1/bind-internal` builds clean; both zones render with forwarder `198.18.200.8` and there is no residual `198.18.19.20`. ## Merge gate - PR 2 (`benvin/externaldns-incluster`) merged, AND - record parity confirmed between legacy and in-cluster for the forward zone. Spot-check (repeat for each name): ``` for n in puppetca puppet puppetdb encapi pdbmux artifactapi consul; do echo "$n:" dig +short @198.18.19.20 A $n.k8s.syd1.au.unkin.net dig +short @198.18.200.8 A $n.k8s.syd1.au.unkin.net done # plus 2-3 PTRs in the reverse zone: dig +short @198.18.19.20 -x 198.18.200.8 dig +short @198.18.200.8 -x 198.18.200.8 ``` A/PTR answers from `198.18.200.8` must match those from `198.18.19.20` before merging. ## Verification (after merge) ``` dig +short @198.18.200.7 A puppet.k8s.syd1.au.unkin.net # resolvers VIP dig +short @198.18.200.7 -x 198.18.200.8 # reverse via resolvers ``` Resolution through the `bind-resolvers` VIP should now answer for both the forward and reverse k8s zones. ## Rollback Revert this PR — the `fwd-k8s-syd1-au-unkin-net` forwarder returns to `198.18.19.20` and the reverse forward is removed. The legacy VM is untouched and remains authoritative until decommission. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/288 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../resolvers/forward-zones.yaml | 34 ++++++++++++------- 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/apps/base/bind-internal/resolvers/forward-zones.yaml b/apps/base/bind-internal/resolvers/forward-zones.yaml index 5e18a34..9afb3e4 100644 --- a/apps/base/bind-internal/resolvers/forward-zones.yaml +++ b/apps/base/bind-internal/resolvers/forward-zones.yaml @@ -1,12 +1,9 @@ # Conditional forward zones, from the puppet openforwarder view. -# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14. -# k8s -> TEMPORARY: the existing external external-dns bind service anycast -# 198.18.19.20 (puppet roles::infra::dns::externaldns, ausyd1nxvm2127 + slaves), -# NOT the in-cluster bind-externaldns 198.18.200.8. The external service still -# holds the working k8s.syd1.au.unkin.net records; the in-cluster one is not -# reliably serving them yet, so forwarding there returns NXDOMAIN (which -# currently breaks Gitea's CI webhook: it cannot resolve the k8s CI host). -# Revert to 198.18.200.8 once external-dns publishes to the in-cluster service. +# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14, +# k8s 198.18.200.8 (in-cluster bind-externaldns VIP). +# k8s -> in-cluster bind-externaldns 198.18.200.8 for both the forward zone +# k8s.syd1.au.unkin.net and the reverse zone 200.18.198.in-addr.arpa, which +# external-dns now publishes to (see the external-dns migration PRs). # (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.) --- apiVersion: bind.unkin.net/v1alpha1 @@ -63,10 +60,23 @@ spec: type: forward catalog: false forwarders: - # TEMPORARY: existing external external-dns bind service anycast, which - # currently holds the k8s.syd1.au.unkin.net records. Revert to 198.18.200.8 - # (in-cluster bind-externaldns) once external-dns publishes there. - - 198.18.19.20 + - 198.18.200.8 +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: BindZone +metadata: + name: fwd-200-18-198-in-addr-arpa + namespace: bind-internal +spec: + clusterRef: bind-resolvers + viewRef: openforwarder + zoneName: 200.18.198.in-addr.arpa + type: forward + catalog: false + forwarders: + # Reverse zone for the k8s LB range, published by external-dns to the + # in-cluster bind-externaldns alongside k8s.syd1.au.unkin.net. + - 198.18.200.8 --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone