From 8eeca2d1fb962d4e5e76eab8060fb9f5dd33c4e9 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 25 Jul 2026 22:37:39 +1000
Subject: [PATCH] Reflect externaldns TSIG key into the externaldns namespace
 (#285)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

Step 1 of 3 in the external-dns → in-cluster bind migration. For external-dns to send RFC2136 updates to the in-cluster `bind-externaldns` primary, it must present the exact TSIG key the primary's `allow-update` accepts. The bind-operator generates that key material into Secret `externaldns-key-tsig` in `bind-internal`; reflecting it into the `externaldns` namespace removes the manual eyaml→Vault key sync and guarantees key parity.

## Changes

- Adds `spec.secretTemplate.annotations` to BindTSIGKey `externaldns-key` with the emberstack reflector hints: `reflection-allowed`, `reflection-allowed-namespaces: externaldns`, `reflection-auto-enabled`, `reflection-auto-namespaces: externaldns`.
- Regenerates `schemas/bind.unkin.net/bindtsigkey_v1alpha1.json` from the live CRD (deployed bind-operator v0.2.4 already exposes `secretTemplate` — the WIP branch's ">= v0.3.0" claim is stale) to add the `secretTemplate` property. Schema output is byte-identical to running `ci/generate-schemas.sh`.

`kubectl kustomize apps/overlays/au-syd1/bind-internal` builds clean and renders the annotations onto the BindTSIGKey.

## Verification (after merge)

```
kubectl -n externaldns get secret externaldns-key-tsig \
  -o jsonpath='{.data.secret} {.data.algorithm}{"\n"}'
```
Both `secret` and `algorithm` keys must be present (reflector mirrored the source Secret from bind-internal).

## Rollback

Revert this PR. The source Secret in bind-internal is unaffected; only the reflected mirror in `externaldns` is removed.

Merge order: this is PR 1/3. PR 2 (repoint external-dns) must not merge until the reflected secret is verified.

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/285
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 .../base/bind-internal/externaldns/tsigkey.yaml | 12 +++++++++++-
 .../bind.unkin.net/bindtsigkey_v1alpha1.json    | 17 +++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/apps/base/bind-internal/externaldns/tsigkey.yaml b/apps/base/bind-internal/externaldns/tsigkey.yaml
index 33ec5ce..1913a9d 100644
--- a/apps/base/bind-internal/externaldns/tsigkey.yaml
+++ b/apps/base/bind-internal/externaldns/tsigkey.yaml
@@ -1,6 +1,10 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
+# updates to the primary. The operator generates the material into a Secret
+# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
+# reflector hints onto that Secret so it is mirrored into the externaldns
+# namespace, where the external-dns controller reads it -- guaranteeing
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -9,3 +13,9 @@ metadata:
 spec:
   clusterRef: bind-externaldns
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"
diff --git a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
index 2b3ae33..affd4fd 100644
--- a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
+++ b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
@@ -35,6 +35,23 @@
         },
         "secretName": {
           "type": "string"
+        },
+        "secretTemplate": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"