From 812a9a2f2baaff7ed55b4d5a5d16af2529a18cc1 Mon Sep 17 00:00:00 2001 From: Unkin Agent Date: Sat, 26 Sep 2026 16:42:02 +1000 Subject: [PATCH] Publish real delegation records for acme.unkin.net (#486) The acme.unkin.net zone still serves only the bind-operator seed apex: NS ns1.acme.unkin.net glued to A 10.42.6.38, a pod IP no pod holds. The parent delegates to acme-ns1.unkin.net, but public resolvers have already promoted the child NS RRset, so when the cached address expires DNS-01 fails for every unkin.net wildcard at once. - Add apex NS acme-ns1.unkin.net., matching the parent delegation (out of zone, no glue needed). - Point ns1.acme.unkin.net at 103.216.191.185 so resolvers holding the seeded NS name still reach the zone. - The operator seed placeholder itself is tracked separately in bind-operator. --------- Co-authored-by: unkin-agent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/486 Co-authored-by: Unkin Agent Co-committed-by: Unkin Agent --- apps/base/bind-external/kustomization.yaml | 1 + apps/base/bind-external/records.yaml | 36 ++++++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 apps/base/bind-external/records.yaml diff --git a/apps/base/bind-external/kustomization.yaml b/apps/base/bind-external/kustomization.yaml index 1e3ed86..6d73342 100644 --- a/apps/base/bind-external/kustomization.yaml +++ b/apps/base/bind-external/kustomization.yaml @@ -7,4 +7,5 @@ resources: - cluster.yaml - tsigkey.yaml - zones.yaml + - records.yaml - agent-dns-rolebinding.yaml diff --git a/apps/base/bind-external/records.yaml b/apps/base/bind-external/records.yaml new file mode 100644 index 0000000..d37c45d --- /dev/null +++ b/apps/base/bind-external/records.yaml @@ -0,0 +1,36 @@ +# Authoritative delegation records for acme.unkin.net. Without these the zone +# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the +# primary pod IP), which is unroutable off-cluster and goes stale on +# reschedule. DNSRecords must live in the same namespace as their BindZone. +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: acme-apex-ns + namespace: bind-external +spec: + zoneRef: acme-unkin-net + # "@" is the zone apex. + name: "@" + type: NS + ttl: 3600 + values: + # Matches the parent delegation in Google Cloud DNS. Out of zone, so the + # child needs no glue of its own. + - acme-ns1.unkin.net. +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: acme-ns1-a + namespace: bind-external +spec: + zoneRef: acme-unkin-net + name: ns1 + type: A + ttl: 3600 + values: + # Public address of this cluster's external BIND, same target as + # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net + # NS name must still reach the zone. + - 103.216.191.185