unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

TEMP: forward k8s.syd1.au.unkin.net to external external-dns service (#269)

Browse Source 
The bind-resolvers `openforwarder` view forwarded `k8s.syd1.au.unkin.net` to the in-cluster bind-externaldns (198.18.200.8), which is not reliably serving those records yet, so lookups return NXDOMAIN.

Concrete impact: Gitea cannot resolve the k8s-hosted CI host, so its outbound webhook fails and tagged releases never trigger CI (e.g. cutting a new bind-operator release from a tag).

This points the `fwd-k8s-syd1-au-unkin-net` forwarder at the existing external external-dns bind service anycast **198.18.19.20** (puppet `roles::infra::dns::externaldns` — master `ausyd1nxvm2127` + slaves `2128`/`2129`, advertised via OSPF), which still holds the working `k8s.syd1.au.unkin.net` records. It is in the same 198.18.19.0/24 anycast family as the consul forwarder (198.18.19.14) the resolvers already use, so it is reachable from the pods.

Temporary measure. Revert to 198.18.200.8 once external-dns publishes to the in-cluster bind-externaldns service. Only the forward target changes; no CRD/schema changes.

Reviewed-on: #269
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #269.
This commit is contained in:
Ben Vincent
2026-07-21 00:14:03 +10:00
committed by BenVincent
parent 0c1156282f
commit 7ee5dfbbcd
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/bind-internal/resolvers/forward-zones.yaml
+12 -3
View File
@@ -1,6 +1,12 @@
# Conditional forward zones, from the puppet openforwarder view.
# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14, k8s 198.18.200.8.
# k8s -> in-cluster bind-externaldns 198.18.200.8.
# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14.
# k8s -> TEMPORARY: the existing external external-dns bind service anycast
# 198.18.19.20 (puppet roles::infra::dns::externaldns, ausyd1nxvm2127 + slaves),
# NOT the in-cluster bind-externaldns 198.18.200.8. The external service still
# holds the working k8s.syd1.au.unkin.net records; the in-cluster one is not
# reliably serving them yet, so forwarding there returns NXDOMAIN (which
# currently breaks Gitea's CI webhook: it cannot resolve the k8s CI host).
# Revert to 198.18.200.8 once external-dns publishes to the in-cluster service.
# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
---
apiVersion: bind.unkin.net/v1alpha1
@@ -57,7 +63,10 @@ spec:
type: forward
catalog: false
forwarders:
- 198.18.200.8
# TEMPORARY: existing external external-dns bind service anycast, which
# currently holds the k8s.syd1.au.unkin.net records. Revert to 198.18.200.8
# (in-cluster bind-externaldns) once external-dns publishes there.
- 198.18.19.20
---
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone