From 8dc65779a5dc3e21e7182c57695de852064e3c33 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 22:41:20 +1000 Subject: [PATCH] Repoint external-dns at the in-cluster bind-externaldns primary (#287) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Step 2 of 3 in the external-dns → in-cluster bind migration. external-dns currently pushes RFC2136 updates to the legacy VM `ausyd1nxvm2127.main.unkin.net`. This repoints it at the in-cluster `bind-externaldns` primary so the in-cluster zone becomes the live source of truth for `k8s.syd1.au.unkin.net` + `200.18.198.in-addr.arpa`. ## Changes - Points `--rfc2136-host` at `bind-externaldns-primary.bind-internal.svc.cluster.local` (verified live: ClusterIP Service `bind-externaldns-primary` exists in `bind-internal`). - Reads TSIG `secret` + `algorithm` from Secret `externaldns-key-tsig` (reflected by PR 1) instead of the Vault-backed `externaldns-tsig`. - Keeps port, zones, keyname, and `txtOwnerId: k8s` unchanged. - Leaves the old Vault manifests (`apps/base/externaldns/{vaultauth,vaultstaticsecret}.yaml`) in place as the rollback path; their removal is a later cleanup PR. ## Merge gate - PR 1 (`benvin/externaldns-tsig-reflect`) merged, AND - `kubectl -n externaldns get secret externaldns-key-tsig` returns keys `secret` + `algorithm`. ## TXT-registry note `policy: sync` + `registry: txt`: on first reconcile against the (currently empty) in-cluster zone, external-dns re-creates all managed A/CNAME records and their ownership TXTs from scratch. This is expected and populates the zone. ## Verification (after merge) ``` kubectl -n externaldns logs deploy/externaldns --tail=100 | grep -Ei 'rfc2136|BADKEY|NOTAUTH|added|update' dig +short @198.18.200.8 A puppet.k8s.syd1.au.unkin.net ``` Logs should show updates to `bind-externaldns-primary...` with NO `BADKEY`/`NOTAUTH`; sampled A records should start resolving against the in-cluster server (198.18.200.8) as the sync populates the zone. ## Rollback Revert this PR (host + secret name back to `ausyd1nxvm2127.main.unkin.net` / `externaldns-tsig`). The legacy VM is untouched and still authoritative. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/287 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/overlays/au-syd1/externaldns/values.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/overlays/au-syd1/externaldns/values.yaml b/apps/overlays/au-syd1/externaldns/values.yaml index fa807c2..107e83e 100644 --- a/apps/overlays/au-syd1/externaldns/values.yaml +++ b/apps/overlays/au-syd1/externaldns/values.yaml @@ -27,22 +27,24 @@ sources: - gateway-httproute - gateway-grpcroute -# Environment variables for TSIG secret and algorithm from Vault +# TSIG secret + algorithm. The bind operator generates this key in +# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector +# mirrors the Secret into this namespace as externaldns-key-tsig. env: - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET valueFrom: secretKeyRef: - name: externaldns-tsig + name: externaldns-key-tsig key: secret - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM valueFrom: secretKeyRef: - name: externaldns-tsig + name: externaldns-key-tsig key: algorithm # RFC2136 configuration as arguments extraArgs: - - --rfc2136-host=ausyd1nxvm2127.main.unkin.net + - --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local - --rfc2136-port=53 - --rfc2136-zone=k8s.syd1.au.unkin.net - --rfc2136-zone=200.18.198.in-addr.arpa