Configure resolvers like puppet (openforwarder view + forward zones)

Fixes recursion being refused for external clients: the resolver had no
allow-recursion, so BIND defaulted to localnets. Mirrors the puppet
resolver config exactly.

- add openforwarder BindView: match-clients = internal ACLs, recursion
  yes, allow-recursion/allow-query any (match-clients gates access)
- add 4 BindACLs (acl-main.unkin.net / acl-dmz / acl-common /
  acl-nomad-jobs) from puppet acls.conf
- add 26 conditional forward zones (unkin/consul/k8s/dmz upstreams),
  bound to the openforwarder view; needs operator v0.1.4 to render them
  on every pod
- global forwarders 8.8.8.8/1.1.1.1 (puppet default)
- bump operator image to v0.1.4

apps/base/artifactapi/api-deployment.yaml

@@ -35,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/bind-internal/authoritative/cluster.yaml

@@ -4,8 +4,8 @@
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
-  name: auth
+  name: bind-authoritative
-  namespace: binddns-auth
+  namespace: bind-internal
 spec:
   mode: authoritative
   replicas: 3
@@ -15,7 +15,8 @@ spec:
     type: LoadBalancer
     annotations:
       purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
+      purelb.io/addresses: 198.18.200.6
+      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
   resources:
     requests:
       cpu: 100m
@@ -28,9 +29,9 @@ spec:
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCatalogZone
 metadata:
-  name: auth-catalog
+  name: bind-authoritative-catalog
-  namespace: binddns-auth
+  namespace: bind-internal
 spec:
-  clusterRef: auth
+  clusterRef: bind-authoritative
   zoneName: catalog.internal
   transferKeyRef: transfer-key

apps/base/bind-internal/authoritative/kustomization.yaml

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - namespace.yaml
-  - tsigkey.yaml
   - cluster.yaml
+  - tsigkey.yaml
+  - zones.yaml

apps/base/bind-internal/authoritative/tsigkey.yaml

@@ -5,6 +5,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
   name: transfer-key
-  namespace: binddns-auth
+  namespace: bind-internal
 spec:
+  clusterRef: bind-authoritative
   algorithm: hmac-sha256

apps/base/bind-internal/authoritative/zones.yaml

@@ -0,0 +1,204 @@
+# Authoritative zones migrated from puppet-prod
+# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
+# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
+# Record data is populated by PuppetDB exported resources upstream, so it is
+# NOT in this repo — migrate it into these zones (AXFR from the current masters,
+# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: unkin.net
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: main-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: main.unkin.net
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 13-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 13.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 14-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 14.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 15-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 15.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 16-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 16.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 17-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 17.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 19-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 19.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 20-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 20.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 21-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 21.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 22-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 22.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 23-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 23.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 24-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 24.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 25-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 25.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 26-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 26.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 27-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 27.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 28-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 28.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 29-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-authoritative
+  zoneName: 29.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600

apps/base/bind-internal/externaldns/cluster.yaml

@@ -0,0 +1,39 @@
+---
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCluster
+metadata:
+  name: bind-externaldns
+  namespace: bind-internal
+spec:
+  mode: authoritative
+  replicas: 3
+  storageClassName: cephrbd-fast-delete
+  storageSize: 1Gi
+  service:
+    type: LoadBalancer
+    annotations:
+      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.8
+      external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: "1"
+      memory: 512Mi
+---
+# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
+# (external-dns writes to the primary; secondaries IXFR the result).
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindCatalogZone
+metadata:
+  name: bind-externaldns-catalog
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: catalog.externaldns.internal
+  transferKeyRef: externaldns-key

apps/base/bind-internal/externaldns/kustomization.yaml

@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - namespace.yaml
-  - tsigkey.yaml
   - cluster.yaml
+  - tsigkey.yaml
+  - zones.yaml

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -5,6 +5,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
   name: externaldns-key
-  namespace: binddns-externaldns
+  namespace: bind-internal
 spec:
+  clusterRef: bind-externaldns
   algorithm: hmac-sha256

apps/base/bind-internal/externaldns/zones.yaml

@@ -0,0 +1,34 @@
+# k8s external-dns zones migrated from puppet-prod
+# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
+# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
+# records here via RFC2136 authenticated with externaldns-key.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: k8s-syd1-au-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: k8s.syd1.au.unkin.net
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: 200-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-externaldns
+  zoneName: 200.18.198.in-addr.arpa
+  type: primary
+  defaultTTL: 600
+  dynamicUpdate: true
+  updateKeyRef: externaldns-key
+  allowTransfer:
+    - key externaldns-key

apps/base/bind-internal/kustomization.yaml

@@ -4,4 +4,6 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
-  - cluster.yaml
+  - authoritative
+  - resolvers
+  - externaldns

apps/base/bind-internal/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: binddns-auth
+  name: bind-internal

apps/base/bind-internal/resolvers/acls.yaml

@@ -0,0 +1,65 @@
+# Internal client ACLs, mirrored from puppet /etc/named/acls.conf.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: acl-main.unkin.net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  entries:
+    - 198.18.1.10/32
+    - 198.18.2.160/27
+    - 198.18.21.160/27
+    - 198.18.2.192/27
+    - 198.18.21.192/27
+    - 198.18.13.0/24
+    - 198.18.14.0/24
+    - 198.18.15.0/24
+    - 198.18.16.0/24
+    - 198.18.17.0/24
+    - 198.18.18.0/24
+    - 198.18.19.0/24
+    - 198.18.20.0/24
+    - 198.18.21.0/24
+    - 198.18.22.0/24
+    - 198.18.23.0/24
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: acl-dmz
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  entries:
+    - 198.18.24.0/24
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: acl-common
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  entries:
+    - 198.18.25.0/24
+    - 198.18.26.0/24
+    - 198.18.27.0/24
+    - 198.18.28.0/24
+    - 198.18.29.0/24
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindACL
+metadata:
+  name: acl-nomad-jobs
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  entries:
+    - 198.18.64.0/24
+    - 198.18.65.0/24
+    - 198.18.66.0/24
+    - 198.18.67.0/24
+    - 198.18.68.0/24
+    - 198.18.69.0/24

apps/base/bind-internal/resolvers/cluster.yaml

@@ -4,8 +4,8 @@
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
-  name: resolver
+  name: bind-resolvers
-  namespace: binddns-resolver
+  namespace: bind-internal
 spec:
   mode: resolver
   replicas: 3
@@ -15,10 +15,11 @@ spec:
     type: LoadBalancer
     annotations:
       purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
+      purelb.io/addresses: 198.18.200.7
+      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
   forwarders:
+    - 8.8.8.8
     - 1.1.1.1
-    - 9.9.9.9
   resources:
     requests:
       cpu: 100m

apps/base/bind-internal/resolvers/forward-zones.yaml

@@ -0,0 +1,374 @@
+# Conditional forward zones, mirrored from puppet openforwarder view.
+# Upstreams are the puppet anycast servers (unkin 198.18.19.15, consul .14,
+# k8s .20); flip to the in-cluster authoritative/externaldns LBs once zone
+# data is migrated.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-main-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: main.unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-dmz-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: dmz.unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-network-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: network.unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-prod-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: prod.unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-consul
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: consul
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.14
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-k8s-syd1-au-unkin-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: k8s.syd1.au.unkin.net
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.20
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-13-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 13.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-14-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 14.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-15-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 15.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-16-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 16.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-17-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 17.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-19-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 19.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-20-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 20.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-21-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 21.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-22-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 22.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-23-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 23.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-24-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 24.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-25-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 25.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-26-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 26.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-27-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 27.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-28-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 28.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-29-18-198-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 29.18.198.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 198.18.19.15
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-8-10-10-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 8.10.10.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-16-10-10-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 16.10.10.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: fwd-20-10-10-in-addr-arpa
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: 20.10.10.in-addr.arpa
+  type: forward
+  catalog: false
+  forwarders:
+    - 10.10.16.32
+    - 10.10.16.33

apps/base/bind-internal/resolvers/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cluster.yaml
+  - acls.yaml
+  - view.yaml
+  - forward-zones.yaml

apps/base/bind-internal/resolvers/view.yaml

@@ -0,0 +1,23 @@
+---
+# openforwarder view, mirrored from puppet /etc/named/views.conf.
+# match-clients gates access to internal networks; recursion/query are 'any'
+# within the view since match-clients already restricts who reaches it.
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindView
+metadata:
+  name: openforwarder
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  order: 100
+  matchClients:
+    - acl-main.unkin.net
+    - acl-nomad-jobs
+    - acl-common
+    - acl-dmz
+  recursion: true
+  allowQuery:
+    - any
+  extraOptions:
+    - "allow-recursion { any; }"
+    - "allow-query-cache { any; }"

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.1.1
+          image: git.unkin.net/unkin/bind-operator:v0.1.4
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/bind-system/kustomization.yaml

@@ -6,6 +6,6 @@ resources:
   - namespace.yaml
   # CRDs are pulled from the bind-operator repo at the matching tag rather than
   # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.3/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml

apps/base/binddns-externaldns/cluster.yaml

@@ -1,26 +0,0 @@
----
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: externaldns
-  namespace: binddns-externaldns
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: dmz
-      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi

apps/base/binddns-externaldns/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-externaldns

apps/base/binddns-resolver/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-resolver

apps/overlays/au-syd1/bind-internal/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/binddns-auth
+  - ../../../base/bind-internal

apps/overlays/au-syd1/binddns-externaldns/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-externaldns

apps/overlays/au-syd1/binddns-resolver/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-resolver

argocd/applicationsets/platform.yaml

@@ -13,9 +13,7 @@ spec:
       - path: apps/overlays/*/authentik
       - path: apps/overlays/*/artifactapi
       - path: apps/overlays/*/bind-system
-      - path: apps/overlays/*/binddns-auth
+      - path: apps/overlays/*/bind-internal
-      - path: apps/overlays/*/binddns-resolver
-      - path: apps/overlays/*/binddns-externaldns
       - path: apps/overlays/*/age-api
       - path: apps/overlays/*/cattle-system
       - path: apps/overlays/*/cert-manager

argocd/projects/platform.yaml

@@ -21,11 +21,7 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'authentik'
       server: https://kubernetes.default.svc
-    - namespace: 'binddns-auth'
+    - namespace: 'bind-internal'
-      server: https://kubernetes.default.svc
-    - namespace: 'binddns-resolver'
-      server: https://kubernetes.default.svc
-    - namespace: 'binddns-externaldns'
       server: https://kubernetes.default.svc
     - namespace: 'cert-manager'
       server: https://kubernetes.default.svc

schemas/bind.unkin.net/bindtsigkey_v1alpha1.json

@@ -24,6 +24,9 @@
           ],
           "type": "string"
         },
+        "clusterRef": {
+          "type": "string"
+        },
         "importExisting": {
           "type": "boolean"
         },