DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the
service needs its own LoadBalancer address instead of a pool-assigned one.
- pin purelb.io/addresses 198.18.200.8 (common pool); move service-group dmz -> common
Adds the external-dns tier (authoritative cluster whose zones accept RFC2136 TSIG updates) + its TSIG key. Stacked on the bind-operator deploy so the
CRDs and kubeconform schemas are present; merge the operator PR first.
- add apps/base/binddns-externaldns and its au-syd1 overlay
Deploys the bind-operator control plane on its own so it can be verified
before any DNS clusters are created. The three BIND tiers follow as
separate PRs.
- add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC,
namespace, and CRDs pulled from the operator repo by raw URL
- add au-syd1 bind-system overlay
- register all four bind apps in the platform ApplicationSet (the DNS
overlays are instantiated only once their dirs land in later PRs)
- add binddns-* namespaces to the platform AppProject destinations
- add schemas/bind.unkin.net/*.json so kubeconform validates the CRs
unkinben