Pin binddns-auth service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.6 (common pool)
Merge branch 'main' into benvin/deploy-binddns-auth
2026-07-03 20:19:54 +10:00 · 2026-07-03 20:06:52 +10:00 · 2026-07-03 20:04:57 +10:00 · 2026-07-03 19:54:30 +10:00 · 2026-07-03 19:54:09 +10:00 · 2026-07-03 19:40:38 +10:00
12 changed files with 3 additions and 103 deletions
@@ -35,7 +35,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -15,6 +15,7 @@ spec:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.6
      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
  resources:
    requests:
@@ -1,26 +0,0 @@
---
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: externaldns
-  namespace: binddns-externaldns
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: dmz
-      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - tsigkey.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-externaldns
@@ -1,10 +0,0 @@
---
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: binddns-externaldns
-spec:
-  algorithm: hmac-sha256
@@ -1,28 +0,0 @@
---
-# Recursive resolvers (replaces the 3x Puppet only-resolver servers).
-# Three identical recursive servers; no zone replication.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: resolver
-  namespace: binddns-resolver
-spec:
-  mode: resolver
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
-  forwarders:
-    - 1.1.1.1
-    - 9.9.9.9
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-resolver
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-externaldns
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-resolver
Author	SHA1	Message	Date
unkinben	74e5a95fd4	Pin binddns-auth service to a dedicated IP ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.6 (common pool)	2026-07-03 20:19:54 +10:00
benvin	fe0e6634fa	Merge branch 'main' into benvin/deploy-binddns-auth ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-07-03 20:06:52 +10:00
unkinben	4b8f9313c8	Deploy bind-operator (operator + CRDs) (#219 ) First of a 4-PR split of the bind rollout (was #216). Deploys just the operator control plane so it can be verified before any DNS clusters exist. ## Why Roll out incrementally: operator + CRDs first, then each BIND tier as its own PR. ## Changes - `apps/base/bind-system`: operator Deployment (`git.unkin.net/unkin/bind-operator:v0.1.1`), RBAC, namespace; CRDs pulled from the operator repo by raw URL (`config/crd/install.yaml` @ v0.1.1) - au-syd1 `bind-system` overlay - register all four bind apps in `argocd/applicationsets/platform.yaml` (DNS overlays instantiate only when their dirs land in the follow-up PRs) - add `binddns-` namespaces to `argocd/projects/platform.yaml` - add `schemas/bind.unkin.net/.json` for kubeconform ## Deploy impact Operator pod + CRDs only. No DNS services yet — the operator is idle until BindClusters exist. ## Follow-ups (merge after this) binddns-auth, binddns-resolver, binddns-externaldns — one PR each. Reviewed-on: #219 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 20:04:57 +10:00
unkinben	66cc5b9a24	Deploy binddns-auth BIND cluster ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Adds the authoritative masters (pod-0 primary + 2 secondaries via catalog/AXFR); includes the catalog zone and transfer TSIG key. Stacked on the bind-operator deploy so the CRDs and kubeconform schemas are present; merge the operator PR first. - add apps/base/binddns-auth and its au-syd1 overlay	2026-07-03 19:54:30 +10:00
unkinben	edbb62cca4	Deploy bind-operator (operator + CRDs) ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Deploys the bind-operator control plane on its own so it can be verified before any DNS clusters are created. The three BIND tiers follow as separate PRs. - add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC, namespace, and CRDs pulled from the operator repo by raw URL - add au-syd1 bind-system overlay - register all four bind apps in the platform ApplicationSet (the DNS overlays are instantiated only once their dirs land in later PRs) - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the CRs	2026-07-03 19:54:09 +10:00
unkinben	bb330a0365	chore(artifactapi): deploy v3.7.4 (#218 ) ## Why artifactapi `v3.7.4` images are built and pushed; au-syd1 is on `v3.7.3`. This rolls forward to ship the terraform provider registry. ## Changes - `api-deployment`: `artifactapi` `v3.7.3` → `v3.7.4` - `ui-deployment`: `artifactapi-ui` `v3.7.3` → `v3.7.4` ## What's new in v3.7.4 - Local terraform repos are now a real provider registry: `/.well-known/terraform.json` + `providers.v1` versions/download with GPG-signed SHA256SUMS (#102). - The signing key self-provisions in the DB (`signing_keys` table) — no K8s secret to mount, so no deployment wiring needed. Once synced, `terraform init` against `source = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"` works. Reviewed-on: #218 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 19:40:38 +10:00