Publish real delegation records for acme.unkin.net (#486)

The acme.unkin.net zone still serves only the bind-operator seed apex: NS ns1.acme.unkin.net glued to A 10.42.6.38, a pod IP no pod holds. The parent delegates to acme-ns1.unkin.net, but public resolvers have already promoted the child NS RRset, so when the cached address expires DNS-01 fails for every unkin.net wildcard at once.

- Add apex NS acme-ns1.unkin.net., matching the parent delegation (out of zone, no glue needed).
- Point ns1.acme.unkin.net at 103.216.191.185 so resolvers holding the seeded NS name still reach the zone.
- The operator seed placeholder itself is tracked separately in bind-operator.

---------

Co-authored-by: unkin-agent <agent@unkin.net>
Reviewed-on: #486
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>

This commit was merged in pull request #486.

This commit is contained in:

Unkin Agent

2026-09-26 16:42:02 +10:00

committed by

BenVincent

parent f37749523d

commit 812a9a2f2b

2 changed files with 37 additions and 0 deletions

									
										apps/base/bind-external/kustomization.yaml
									
		+1
		
												View File
												
				@@ -7,4 +7,5 @@ resources:

				  - cluster.yaml

				  - tsigkey.yaml

				  - zones.yaml

				  - records.yaml

				  - agent-dns-rolebinding.yaml