From c1dba68581c82c862c28f35ce7124781642a5ea6 Mon Sep 17 00:00:00 2001
From: benvin <neotheo@gmail.com>
Date: Sat, 18 Jul 2026 16:26:22 +1000
Subject: [PATCH] bind-internal: add s3.ceph.unkin.net CNAME ->
 radosgw.service.consul

Publish the RGW S3 endpoint name used by cephrgw-operator consumers and the
radosgw cert SAN.

- Add a DNSRecord in the ceph.unkin.net zone: s3 CNAME radosgw.service.consul.
  (Consul service target for now; real target to change later.)
---
 .../base/bind-internal/authoritative/records.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml
index d4bb741..32e1cfa 100644
--- a/apps/base/bind-internal/authoritative/records.yaml
+++ b/apps/base/bind-internal/authoritative/records.yaml
@@ -19,3 +19,18 @@ spec:
     # traefik-internal gateway VIP; the authentik Gateway serves the
     # identity.unkin.net hostname there.
     - 198.18.200.4
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: s3-ceph-cname
+  namespace: bind-internal
+spec:
+  zoneRef: ceph-unkin-net
+  name: s3
+  type: CNAME
+  ttl: 600
+  values:
+    # radosgw S3 endpoint. Points at the Consul service for now; the real
+    # target will be changed later.
+    - radosgw.service.consul.