Pin binddns-externaldns service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.8 (common pool); move service-group dmz -> common
Deploy binddns-externaldns BIND cluster
2026-07-03 20:19:59 +10:00 · 2026-07-03 19:54:33 +10:00 · 2026-07-03 19:54:09 +10:00 · 2026-07-03 19:40:38 +10:00
12 changed files with 4 additions and 114 deletions
@@ -35,7 +35,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -1,36 +0,0 @@
---
-# Authoritative masters (replaces the 3x Puppet authoritative servers).
-# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: auth
-  namespace: binddns-auth
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 2Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
---
-# Catalog zone so new BindZones auto-provision onto the secondaries.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: auth-catalog
-  namespace: binddns-auth
-spec:
-  clusterRef: auth
-  zoneName: catalog.internal
-  transferKeyRef: transfer-key
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - tsigkey.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-auth
@@ -1,10 +0,0 @@
---
-# Zone-transfer / catalog key. The operator generates the material into a
-# Secret (transfer-key-tsig); nothing sensitive is committed to git.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: transfer-key
-  namespace: binddns-auth
-spec:
-  algorithm: hmac-sha256
@@ -15,7 +15,8 @@ spec:
  service:
    type: LoadBalancer
    annotations:
-      purelb.io/service-group: dmz
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.8
      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
  resources:
    requests:
@@ -1,28 +0,0 @@
---
-# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
-# Three identical recursive servers; no zone replication.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: resolver
-  namespace: binddns-resolver
-spec:
-  mode: resolver
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
-  forwarders:
-    - 1.1.1.1
-    - 9.9.9.9
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-resolver
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-auth
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-resolver
Author	SHA1	Message	Date
unkinben	4c9553ce14	Pin binddns-externaldns service to a dedicated IP ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.8 (common pool); move service-group dmz -> common	2026-07-03 20:19:59 +10:00
unkinben	8701f553e7	Deploy binddns-externaldns BIND cluster ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Adds the external-dns tier (authoritative cluster whose zones accept RFC2136 TSIG updates) + its TSIG key. Stacked on the bind-operator deploy so the CRDs and kubeconform schemas are present; merge the operator PR first. - add apps/base/binddns-externaldns and its au-syd1 overlay	2026-07-03 19:54:33 +10:00
unkinben	edbb62cca4	Deploy bind-operator (operator + CRDs) ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Deploys the bind-operator control plane on its own so it can be verified before any DNS clusters are created. The three BIND tiers follow as separate PRs. - add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC, namespace, and CRDs pulled from the operator repo by raw URL - add au-syd1 bind-system overlay - register all four bind apps in the platform ApplicationSet (the DNS overlays are instantiated only once their dirs land in later PRs) - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the CRs	2026-07-03 19:54:09 +10:00
unkinben	bb330a0365	chore(artifactapi): deploy v3.7.4 (#218 ) ## Why artifactapi `v3.7.4` images are built and pushed; au-syd1 is on `v3.7.3`. This rolls forward to ship the terraform provider registry. ## Changes - `api-deployment`: `artifactapi` `v3.7.3` → `v3.7.4` - `ui-deployment`: `artifactapi-ui` `v3.7.3` → `v3.7.4` ## What's new in v3.7.4 - Local terraform repos are now a real provider registry: `/.well-known/terraform.json` + `providers.v1` versions/download with GPG-signed SHA256SUMS (#102). - The signing key self-provisions in the DB (`signing_keys` table) — no K8s secret to mount, so no deployment wiring needed. Once synced, `terraform init` against `source = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"` works. Reviewed-on: #218 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 19:40:38 +10:00