From dc36ea106639da86e8facb37292876ae68f08e50 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sun, 27 Sep 2026 11:20:19 +1000 Subject: [PATCH] split bind-internal DNSRecords into zone/type/record files --- .../ceph-unkin-net/cname/dashboard.yaml | 15 ++ .../ceph-unkin-net/cname/kustomization.yaml | 7 + .../ceph-unkin-net/cname/s3.yaml | 15 ++ .../ceph-unkin-net/kustomization.yaml | 6 + .../authoritative/kustomization.yaml | 7 +- .../bind-internal/authoritative/records.yaml | 164 ------------------ .../authoritative/unkin-net/a/arrstack.yaml | 15 ++ .../authoritative/unkin-net/a/cheeztv.yaml | 15 ++ .../authoritative/unkin-net/a/ghp.yaml | 14 ++ .../authoritative/unkin-net/a/git.yaml | 27 +++ .../authoritative/unkin-net/a/identity.yaml | 17 ++ .../unkin-net/a/kustomization.yaml | 15 ++ .../authoritative/unkin-net/a/lb1.yaml | 13 ++ .../authoritative/unkin-net/a/logviewer.yaml | 15 ++ .../authoritative/unkin-net/a/watchstate.yaml | 15 ++ .../unkin-net/kustomization.yaml | 6 + 16 files changed, 201 insertions(+), 165 deletions(-) create mode 100644 apps/base/bind-internal/authoritative/ceph-unkin-net/cname/dashboard.yaml create mode 100644 apps/base/bind-internal/authoritative/ceph-unkin-net/cname/kustomization.yaml create mode 100644 apps/base/bind-internal/authoritative/ceph-unkin-net/cname/s3.yaml create mode 100644 apps/base/bind-internal/authoritative/ceph-unkin-net/kustomization.yaml delete mode 100644 apps/base/bind-internal/authoritative/records.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/arrstack.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/cheeztv.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/ghp.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/git.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/identity.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/lb1.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/logviewer.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/a/watchstate.yaml create mode 100644 apps/base/bind-internal/authoritative/unkin-net/kustomization.yaml diff --git a/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/dashboard.yaml b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/dashboard.yaml new file mode 100644 index 0000000..e7f2ad7 --- /dev/null +++ b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/dashboard.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: dashboard-ceph-cname + namespace: bind-internal +spec: + zoneRef: ceph-unkin-net + name: dashboard + type: CNAME + ttl: 600 + values: + # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the + # cephrgw-operator) resolve dashboard.ceph.unkin.net. + - lb1.unkin.net. diff --git a/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/kustomization.yaml b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/kustomization.yaml new file mode 100644 index 0000000..e529463 --- /dev/null +++ b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - dashboard.yaml + - s3.yaml diff --git a/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/s3.yaml b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/s3.yaml new file mode 100644 index 0000000..68c3226 --- /dev/null +++ b/apps/base/bind-internal/authoritative/ceph-unkin-net/cname/s3.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: s3-ceph-cname + namespace: bind-internal +spec: + zoneRef: ceph-unkin-net + name: s3 + type: CNAME + ttl: 600 + values: + # radosgw S3 endpoint. Points at the Consul service for now; the real + # target will be changed later. + - radosgw.service.consul. diff --git a/apps/base/bind-internal/authoritative/ceph-unkin-net/kustomization.yaml b/apps/base/bind-internal/authoritative/ceph-unkin-net/kustomization.yaml new file mode 100644 index 0000000..8002a7d --- /dev/null +++ b/apps/base/bind-internal/authoritative/ceph-unkin-net/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - cname diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml index 2e56dd4..98bf4be 100644 --- a/apps/base/bind-internal/authoritative/kustomization.yaml +++ b/apps/base/bind-internal/authoritative/kustomization.yaml @@ -2,9 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +# Individually-managed authoritative records live under //.yaml. +# DNSRecords must live in the same namespace as their BindZone (the operator +# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so +# these sit alongside the zone in bind-internal, not in the app namespace. resources: - cluster.yaml - tsigkey.yaml - zones.yaml - - records.yaml + - unkin-net + - ceph-unkin-net - acls.yaml diff --git a/apps/base/bind-internal/authoritative/records.yaml b/apps/base/bind-internal/authoritative/records.yaml deleted file mode 100644 index e9be28c..0000000 --- a/apps/base/bind-internal/authoritative/records.yaml +++ /dev/null @@ -1,164 +0,0 @@ -# Individually-managed authoritative records for the unkin.net zone. -# DNSRecords must live in the same namespace as their BindZone (the operator -# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so -# these sit alongside the zone in bind-internal, not in the app namespace. ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - # "internal" in the name distinguishes this from the external DNS that - # Authentik will manage its own records from later. - name: identity-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: identity - type: A - ttl: 600 - values: - # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the - # identity.unkin.net hostname there. - - 198.18.199.0 ---- -# PRODUCTION CUTOVER RECORD — intentionally commented out. -# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP -# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this -# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it -# is the FINAL step of the forge migration — gated on the data migration (gitea -# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md. -# NOTE: the live git.unkin.net answer is served by the puppet DNS master today -# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only -# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live -# authority for unkin.net (or update the puppet record instead) before relying -# on this CR at cutover. -# --- -# apiVersion: bind.unkin.net/v1alpha1 -# kind: DNSRecord -# metadata: -# name: git-dns-internal -# namespace: bind-internal -# spec: -# zoneRef: unkin-net -# name: git -# type: A -# ttl: 600 -# values: -# # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there. -# - 198.18.200.4 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: s3-ceph-cname - namespace: bind-internal -spec: - zoneRef: ceph-unkin-net - name: s3 - type: CNAME - ttl: 600 - values: - # radosgw S3 endpoint. Points at the Consul service for now; the real - # target will be changed later. - - radosgw.service.consul. ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: dashboard-ceph-cname - namespace: bind-internal -spec: - zoneRef: ceph-unkin-net - name: dashboard - type: CNAME - ttl: 600 - values: - # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the - # cephrgw-operator) resolve dashboard.ceph.unkin.net. - - lb1.unkin.net. ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: lb1-unkin-net - namespace: bind-internal -spec: - zoneRef: unkin-net - name: lb1 - type: A - ttl: 600 - values: - - 103.216.191.185 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: ghp-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: ghp - type: A - ttl: 600 - values: - # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there. - - 198.18.200.4 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: arrstack-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: arrstack - type: A - ttl: 600 - values: - # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the - # arrstack.unkin.net front door (oauth2-proxy) there. - - 198.18.199.0 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: logviewer-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: logviewer - type: A - ttl: 600 - values: - # traefik-internal gateway VIP; the logviewer Gateway serves - # logviewer.unkin.net there. - - 198.18.200.4 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: cheeztv-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: cheeztv - type: A - ttl: 600 - values: - # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net - # there. - - 198.18.200.4 ---- -apiVersion: bind.unkin.net/v1alpha1 -kind: DNSRecord -metadata: - name: watchstate-dns-internal - namespace: bind-internal -spec: - zoneRef: unkin-net - name: watchstate - type: A - ttl: 600 - values: - # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves - # the watchstate.unkin.net front door (oauth2-proxy) there. - - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/arrstack.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/arrstack.yaml new file mode 100644 index 0000000..db22141 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/arrstack.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: arrstack-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: arrstack + type: A + ttl: 600 + values: + # traefik-EXTERNAL (DMZ) gateway VIP; the arrproxy Gateway serves the + # arrstack.unkin.net front door (oauth2-proxy) there. + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/cheeztv.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/cheeztv.yaml new file mode 100644 index 0000000..20509c6 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/cheeztv.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: cheeztv-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: cheeztv + type: A + ttl: 600 + values: + # traefik-internal gateway VIP; the cheeztv Gateway serves cheeztv.unkin.net + # there. + - 198.18.200.4 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/ghp.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/ghp.yaml new file mode 100644 index 0000000..e86d7f8 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/ghp.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: ghp-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: ghp + type: A + ttl: 600 + values: + # traefik-internal gateway VIP; the ghp Gateway serves ghp.unkin.net there. + - 198.18.200.4 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml new file mode 100644 index 0000000..eaa1f41 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/git.yaml @@ -0,0 +1,27 @@ +--- +# PRODUCTION CUTOVER RECORD — intentionally commented out. +# git.unkin.net currently resolves to the LIVE VM forge (HAProxy VRRP VIP +# 198.18.19.17), which holds every repo the estate depends on. Uncommenting this +# repoints the whole org's git.unkin.net at the new k8s Gitea gateway VIP, so it +# is the FINAL step of the forge migration — gated on the data migration (gitea +# dump/restore + SECRET_KEY copy) in argocd-apps docs/gitea-migration.md. +# NOTE: the live git.unkin.net answer is served by the puppet DNS master today +# (profiles::dns::master, records from PuppetDB); this k8s apex zone holds only +# SOA+NS + a few DNSRecords so far. Confirm the k8s bind cluster is the live +# authority for unkin.net (or update the puppet record instead) before relying +# on this CR at cutover. +# Uncomment this record AND its entry in kustomization.yaml to activate it. +# --- +# apiVersion: bind.unkin.net/v1alpha1 +# kind: DNSRecord +# metadata: +# name: git-dns-internal +# namespace: bind-internal +# spec: +# zoneRef: unkin-net +# name: git +# type: A +# ttl: 600 +# values: +# # traefik-internal gateway VIP; the gitea Gateway serves git.unkin.net there. +# - 198.18.200.4 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/identity.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/identity.yaml new file mode 100644 index 0000000..812a1bf --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/identity.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + # "internal" in the name distinguishes this from the external DNS that + # Authentik will manage its own records from later. + name: identity-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: identity + type: A + ttl: 600 + values: + # traefik-EXTERNAL (DMZ) gateway VIP; the authentik Gateway serves the + # identity.unkin.net hostname there. + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml new file mode 100644 index 0000000..b75d061 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - arrstack.yaml + - cheeztv.yaml + # PRODUCTION CUTOVER RECORD — see git.yaml. Uncomment together with the + # record itself. + # - git.yaml + - ghp.yaml + - identity.yaml + - lb1.yaml + - logviewer.yaml + - watchstate.yaml diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/lb1.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/lb1.yaml new file mode 100644 index 0000000..b4e7c20 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/lb1.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: lb1-unkin-net + namespace: bind-internal +spec: + zoneRef: unkin-net + name: lb1 + type: A + ttl: 600 + values: + - 103.216.191.185 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/logviewer.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/logviewer.yaml new file mode 100644 index 0000000..2c16c9f --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/logviewer.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: logviewer-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: logviewer + type: A + ttl: 600 + values: + # traefik-internal gateway VIP; the logviewer Gateway serves + # logviewer.unkin.net there. + - 198.18.200.4 diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/watchstate.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/watchstate.yaml new file mode 100644 index 0000000..8aa8666 --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/a/watchstate.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bind.unkin.net/v1alpha1 +kind: DNSRecord +metadata: + name: watchstate-dns-internal + namespace: bind-internal +spec: + zoneRef: unkin-net + name: watchstate + type: A + ttl: 600 + values: + # traefik-EXTERNAL (DMZ) gateway VIP; the watchstate-external Gateway serves + # the watchstate.unkin.net front door (oauth2-proxy) there. + - 198.18.199.0 diff --git a/apps/base/bind-internal/authoritative/unkin-net/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/kustomization.yaml new file mode 100644 index 0000000..294f3aa --- /dev/null +++ b/apps/base/bind-internal/authoritative/unkin-net/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - a