Pin binddns-auth service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.6 (common pool)
Merge branch 'main' into benvin/deploy-binddns-auth
2026-07-03 20:19:54 +10:00 · 2026-07-03 20:06:52 +10:00 · 2026-07-03 19:54:30 +10:00 · 2026-07-03 19:54:09 +10:00
5 changed files with 66 additions and 0 deletions
@@ -0,0 +1,37 @@
+---
+# Authoritative masters (replaces the 3x Puppet authoritative servers).
+# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: auth
+  namespace: binddns-auth
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 2Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.6
+      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so new BindZones auto-provision onto the secondaries.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: auth-catalog
+  namespace: binddns-auth
+spec:
+  clusterRef: auth
+  zoneName: catalog.internal
+  transferKeyRef: transfer-key
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - tsigkey.yaml
+  - cluster.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: binddns-auth
@@ -0,0 +1,10 @@
+---
+# Zone-transfer / catalog key. The operator generates the material into a
+# Secret (transfer-key-tsig); nothing sensitive is committed to git.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindTSIGKey
+metadata:
+  name: transfer-key
+  namespace: binddns-auth
+spec:
+  algorithm: hmac-sha256
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/binddns-auth
Author	SHA1	Message	Date
unkinben	74e5a95fd4	Pin binddns-auth service to a dedicated IP ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.6 (common pool)	2026-07-03 20:19:54 +10:00
benvin	fe0e6634fa	Merge branch 'main' into benvin/deploy-binddns-auth ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-07-03 20:06:52 +10:00
unkinben	66cc5b9a24	Deploy binddns-auth BIND cluster ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Adds the authoritative masters (pod-0 primary + 2 secondaries via catalog/AXFR); includes the catalog zone and transfer TSIG key. Stacked on the bind-operator deploy so the CRDs and kubeconform schemas are present; merge the operator PR first. - add apps/base/binddns-auth and its au-syd1 overlay	2026-07-03 19:54:30 +10:00
unkinben	edbb62cca4	Deploy bind-operator (operator + CRDs) ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Deploys the bind-operator control plane on its own so it can be verified before any DNS clusters are created. The three BIND tiers follow as separate PRs. - add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC, namespace, and CRDs pulled from the operator repo by raw URL - add au-syd1 bind-system overlay - register all four bind apps in the platform ApplicationSet (the DNS overlays are instantiated only once their dirs land in later PRs) - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the CRs	2026-07-03 19:54:09 +10:00