From 7ee5dfbbcde51cf823591ccfc2e188fa5427d7f4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 21 Jul 2026 00:14:03 +1000 Subject: [PATCH] TEMP: forward k8s.syd1.au.unkin.net to external external-dns service (#269) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The bind-resolvers `openforwarder` view forwarded `k8s.syd1.au.unkin.net` to the in-cluster bind-externaldns (198.18.200.8), which is not reliably serving those records yet, so lookups return NXDOMAIN. Concrete impact: Gitea cannot resolve the k8s-hosted CI host, so its outbound webhook fails and tagged releases never trigger CI (e.g. cutting a new bind-operator release from a tag). This points the `fwd-k8s-syd1-au-unkin-net` forwarder at the existing external external-dns bind service anycast **198.18.19.20** (puppet `roles::infra::dns::externaldns` — master `ausyd1nxvm2127` + slaves `2128`/`2129`, advertised via OSPF), which still holds the working `k8s.syd1.au.unkin.net` records. It is in the same 198.18.19.0/24 anycast family as the consul forwarder (198.18.19.14) the resolvers already use, so it is reachable from the pods. Temporary measure. Revert to 198.18.200.8 once external-dns publishes to the in-cluster bind-externaldns service. Only the forward target changes; no CRD/schema changes. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/269 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../bind-internal/resolvers/forward-zones.yaml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/apps/base/bind-internal/resolvers/forward-zones.yaml b/apps/base/bind-internal/resolvers/forward-zones.yaml index c4c8e82..5e18a34 100644 --- a/apps/base/bind-internal/resolvers/forward-zones.yaml +++ b/apps/base/bind-internal/resolvers/forward-zones.yaml @@ -1,6 +1,12 @@ # Conditional forward zones, from the puppet openforwarder view. -# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14, k8s 198.18.200.8. -# k8s -> in-cluster bind-externaldns 198.18.200.8. +# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14. +# k8s -> TEMPORARY: the existing external external-dns bind service anycast +# 198.18.19.20 (puppet roles::infra::dns::externaldns, ausyd1nxvm2127 + slaves), +# NOT the in-cluster bind-externaldns 198.18.200.8. The external service still +# holds the working k8s.syd1.au.unkin.net records; the in-cluster one is not +# reliably serving them yet, so forwarding there returns NXDOMAIN (which +# currently breaks Gitea's CI webhook: it cannot resolve the k8s CI host). +# Revert to 198.18.200.8 once external-dns publishes to the in-cluster service. # (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.) --- apiVersion: bind.unkin.net/v1alpha1 @@ -57,7 +63,10 @@ spec: type: forward catalog: false forwarders: - - 198.18.200.8 + # TEMPORARY: existing external external-dns bind service anycast, which + # currently holds the k8s.syd1.au.unkin.net records. Revert to 198.18.200.8 + # (in-cluster bind-externaldns) once external-dns publishes there. + - 198.18.19.20 --- apiVersion: bind.unkin.net/v1alpha1 kind: BindZone