Deploy ns-auth BIND cluster

First of a 4-PR split of the bind rollout (was #216). Deploys just the operator control plane so it can be verified before any DNS clusters exist.

## Why
Roll out incrementally: operator + CRDs first, then each BIND tier as its own PR.

## Changes
- `apps/base/bind-system`: operator Deployment (`git.unkin.net/unkin/bind-operator:v0.1.1`), RBAC, namespace; CRDs pulled from the operator repo by raw URL (`config/crd/install.yaml` @ v0.1.1)
- au-syd1 `bind-system` overlay
- register all four bind apps in `argocd/applicationsets/platform.yaml` (DNS overlays instantiate only when their dirs land in the follow-up PRs)
- add `binddns-*` namespaces to `argocd/projects/platform.yaml`
- add `schemas/bind.unkin.net/*.json` for kubeconform

## Deploy impact
Operator pod + CRDs only. No DNS services yet — the operator is idle until BindClusters exist.

## Follow-ups (merge after this)
binddns-auth, binddns-resolver, binddns-externaldns — one PR each.

Reviewed-on: #219
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/artifactapi/api-deployment.yaml

@@ -35,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/binddns-externaldns/cluster.yaml

@@ -1,26 +0,0 @@
----
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: externaldns
-  namespace: binddns-externaldns
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: dmz
-      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi

apps/base/binddns-externaldns/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - tsigkey.yaml
-  - cluster.yaml

apps/base/binddns-externaldns/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-externaldns

apps/base/binddns-externaldns/tsigkey.yaml

@@ -1,10 +0,0 @@
----
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: binddns-externaldns
-spec:
-  algorithm: hmac-sha256

apps/base/binddns-resolver/cluster.yaml

@@ -1,28 +0,0 @@
----
-# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
-# Three identical recursive servers; no zone replication.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: resolver
-  namespace: binddns-resolver
-spec:
-  mode: resolver
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
-  forwarders:
-    - 1.1.1.1
-    - 9.9.9.9
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi

apps/base/binddns-resolver/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cluster.yaml

apps/base/binddns-resolver/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-resolver

apps/base/ns-auth/cluster.yaml

@@ -5,7 +5,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: auth
-  namespace: binddns-auth
+  namespace: ns-auth
 spec:
   mode: authoritative
   replicas: 3
@@ -15,6 +15,7 @@ spec:
     type: LoadBalancer
     annotations:
       purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.6
       external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
   resources:
     requests:
@@ -29,7 +30,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCatalogZone
 metadata:
   name: auth-catalog
-  namespace: binddns-auth
+  namespace: ns-auth
 spec:
   clusterRef: auth
   zoneName: catalog.internal

apps/base/ns-auth/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: binddns-auth
+  name: ns-auth

apps/base/ns-auth/tsigkey.yaml

@@ -5,6 +5,6 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
   name: transfer-key
-  namespace: binddns-auth
+  namespace: ns-auth
 spec:
   algorithm: hmac-sha256

apps/overlays/au-syd1/binddns-externaldns/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-externaldns

apps/overlays/au-syd1/binddns-resolver/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-resolver

apps/overlays/au-syd1/ns-auth/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/binddns-auth
+  - ../../../base/ns-auth