From f9dd90a6b018c189d81871e3d90b4459e9482a2f Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 4 Jul 2026 21:58:13 +1000
Subject: [PATCH] Restrict authoritative queries to internal networks

Mirrors the puppet authoritative master-zones view (match-clients
acl-main.unkin.net) using a global allow-query instead of a view, since
dynamic primary zones in a view would need per-view allow-new-zones.

- add auth-acl-main BindACL (the puppet acl-main.unkin.net networks)
- allow-query { auth-acl-main; 10.42.0.0/16; } on bind-authoritative
  (pod net included so secondaries can SOA-refresh from the primary)
---
 .../bind-internal/authoritative/acls.yaml     | 26 +++++++++++++++++++
 .../bind-internal/authoritative/cluster.yaml  |  5 ++++
 .../authoritative/kustomization.yaml          |  1 +
 3 files changed, 32 insertions(+)
 create mode 100644 apps/base/bind-internal/authoritative/acls.yaml

diff --git a/apps/base/bind-internal/authoritative/acls.yaml b/apps/base/bind-internal/authoritative/acls.yaml
new file mode 100644
index 0000000..d042b2a
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/acls.yaml
@@ -0,0 +1,26 @@
+---
+# Internal client networks allowed to query the authoritative servers,
+# mirrored from the puppet authoritative /etc/named/acls.conf
+# (acl-main.unkin.net). Named auth-acl-main because the resolver has its own,
+# differently-scoped acl-main.unkin.net in the same namespace.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: auth-acl-main
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  entries:
+    - 198.18.13.0/24
+    - 198.18.14.0/24
+    - 198.18.15.0/24
+    - 198.18.16.0/24
+    - 198.18.17.0/24
+    - 198.18.19.0/24
+    - 198.18.20.0/24
+    - 198.18.24.0/24
+    - 198.18.25.0/24
+    - 198.18.26.0/24
+    - 198.18.27.0/24
+    - 198.18.28.0/24
+    - 198.18.29.0/24
diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml
index 13307d3..ea08a66 100644
--- a/apps/base/bind-internal/authoritative/cluster.yaml
+++ b/apps/base/bind-internal/authoritative/cluster.yaml
@@ -11,6 +11,11 @@ spec:
   replicas: 3
   storageClassName: cephrbd-fast-delete
   storageSize: 2Gi
+  # Restrict queries to internal networks (puppet acl-main.unkin.net).
+  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
+  # from the primary during catalog replication.
+  extraOptions:
+    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
   service:
     type: LoadBalancer
     annotations:
diff --git a/apps/base/bind-internal/authoritative/kustomization.yaml b/apps/base/bind-internal/authoritative/kustomization.yaml
index d69be1f..2116a01 100644
--- a/apps/base/bind-internal/authoritative/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - acls.yaml