Writes (RFC2136/nsupdate) must hit pod-0; the round-robin read Service
would land them on a secondary. Add a dedicated write endpoint per
cluster (operator v0.1.5 primaryService field).
- bind-authoritative: LoadBalancer write endpoint on 198.18.200.9
- bind-externaldns: ClusterIP write endpoint (in-cluster writers)
- regenerate bindcluster kubeconform schema (primaryService +
externalTrafficPolicy)
external-dns is NOT yet repointed at bind-externaldns-primary: it
authenticates with the existing key, which the operator-generated key
doesn't match until the planned Vault-sync / secret-reflection features
land.
First of a 4-PR split of the bind rollout (was #216). Deploys just the operator control plane so it can be verified before any DNS clusters exist.
## Why
Roll out incrementally: operator + CRDs first, then each BIND tier as its own PR.
## Changes
- `apps/base/bind-system`: operator Deployment (`git.unkin.net/unkin/bind-operator:v0.1.1`), RBAC, namespace; CRDs pulled from the operator repo by raw URL (`config/crd/install.yaml` @ v0.1.1)
- au-syd1 `bind-system` overlay
- register all four bind apps in `argocd/applicationsets/platform.yaml` (DNS overlays instantiate only when their dirs land in the follow-up PRs)
- add `binddns-*` namespaces to `argocd/projects/platform.yaml`
- add `schemas/bind.unkin.net/*.json` for kubeconform
## Deploy impact
Operator pod + CRDs only. No DNS services yet — the operator is idle until BindClusters exist.
## Follow-ups (merge after this)
binddns-auth, binddns-resolver, binddns-externaldns — one PR each.
Reviewed-on: #219
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
unkinben