From c353fa797bb19fab604fe69a56740e778103259b Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 22:34:16 +1000 Subject: [PATCH] Repoint external-dns at the in-cluster bind-externaldns primary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Step 2 of the external-dns → in-cluster bind migration. external-dns stops sending RFC2136 updates to the legacy VM (ausyd1nxvm2127.main.unkin.net) and targets the in-cluster bind-externaldns primary Service, reading the reflected operator-generated TSIG key. - Point --rfc2136-host at bind-externaldns-primary.bind-internal.svc.cluster.local (ClusterIP Service, verified live). - Read the TSIG secret + algorithm from externaldns-key-tsig (reflected by PR 1) instead of the Vault-backed externaldns-tsig Secret. - Keep port, zones, keyname, txtOwnerId, and the old Vault manifests unchanged; the Vault secret stays as a rollback path and is removed in a later cleanup PR. --- apps/overlays/au-syd1/externaldns/values.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/apps/overlays/au-syd1/externaldns/values.yaml b/apps/overlays/au-syd1/externaldns/values.yaml index fa807c2..107e83e 100644 --- a/apps/overlays/au-syd1/externaldns/values.yaml +++ b/apps/overlays/au-syd1/externaldns/values.yaml @@ -27,22 +27,24 @@ sources: - gateway-httproute - gateway-grpcroute -# Environment variables for TSIG secret and algorithm from Vault +# TSIG secret + algorithm. The bind operator generates this key in +# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector +# mirrors the Secret into this namespace as externaldns-key-tsig. env: - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET valueFrom: secretKeyRef: - name: externaldns-tsig + name: externaldns-key-tsig key: secret - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM valueFrom: secretKeyRef: - name: externaldns-tsig + name: externaldns-key-tsig key: algorithm # RFC2136 configuration as arguments extraArgs: - - --rfc2136-host=ausyd1nxvm2127.main.unkin.net + - --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local - --rfc2136-port=53 - --rfc2136-zone=k8s.syd1.au.unkin.net - --rfc2136-zone=200.18.198.in-addr.arpa