bind-internal: allow admin workstation + router to query authoritative (#258)

## Why
Allow the operator's workstation and router to query the bind-authoritative servers directly. Their source addresses are outside the existing `auth-acl-main` client subnets, so named returns REFUSED to them today. The router sits on 198.18.21.0/24 which is not in the ACL at all.

## Changes
- Add `10.10.12.200/32` (workstation, over wireguard) to `auth-acl-main`
- Add `198.18.21.160/32` (router) to `auth-acl-main`

## Note
This grants query permission only. Reaching the LoadBalancer VIP (198.18.200.6) from off-datacenter paths is separately gated by `externalTrafficPolicy: Local`; the workstation-over-wireguard path still needs its L4 routing addressed to actually land on a node with a ready endpoint.

Reviewed-on: #258
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

This commit was merged in pull request #258.

This commit is contained in:

Ben Vincent

2026-07-16 22:56:22 +10:00

committed by

BenVincent

parent b1b2112c66

commit 8f164873e0

1 changed files with 3 additions and 0 deletions

									
										apps/base/bind-internal/authoritative/acls.yaml
									
		+3
		
												View File
												
					@@ -24,3 +24,6 @@ spec:

					    - 198.18.27.0/24

					    - 198.18.27.0/24

					    - 198.18.28.0/24

					    - 198.18.28.0/24

					    - 198.18.29.0/24

					    - 198.18.29.0/24

					    # Admin/management access (individual hosts, not whole subnets)

					    - 10.10.12.200/32   # benvin workstation (wireguard)

					    - 198.18.21.160/32  # benvin router