From eff97b8d03179620b1db91211822d9d2de1098a1 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 26 Jul 2026 00:05:54 +1000 Subject: [PATCH] Enable PTR synthesis in external-dns (#292) Post-cutover verification (argocd-apps#288) found the reverse zone 200.18.198.in-addr.arpa empty: external-dns only writes PTRs when --rfc2136-create-ptr is set, and nothing else feeds that zone. Reverse resolution for the k8s LB range was already absent for clients pre-migration (no forwarder existed), so this completes the reverse path rather than fixing a regression. - Adds --rfc2136-create-ptr to the external-dns rfc2136 args Verification after merge: dig -x 198.18.200.2 @198.18.200.7 returns puppetca.k8s.syd1.au.unkin.net (allow a reconcile cycle + negative-cache expiry). Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/292 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/overlays/au-syd1/externaldns/values.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/overlays/au-syd1/externaldns/values.yaml b/apps/overlays/au-syd1/externaldns/values.yaml index 107e83e..865aa0c 100644 --- a/apps/overlays/au-syd1/externaldns/values.yaml +++ b/apps/overlays/au-syd1/externaldns/values.yaml @@ -48,6 +48,10 @@ extraArgs: - --rfc2136-port=53 - --rfc2136-zone=k8s.syd1.au.unkin.net - --rfc2136-zone=200.18.198.in-addr.arpa + # Synthesize PTR records into the reverse zone for every A record managed in + # the forward zone (the reverse zone + resolver forwarder exist since #288; + # without this flag nothing writes PTRs). + - --rfc2136-create-ptr - --rfc2136-tsig-keyname=externaldns-key - --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM) - --rfc2136-tsig-axfr