Pin binddns-resolver service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.7 (common pool)
Deploy binddns-resolver BIND cluster
2026-07-03 20:19:57 +10:00 · 2026-07-03 19:54:32 +10:00 · 2026-07-03 19:54:09 +10:00 · 2026-07-03 19:40:38 +10:00
13 changed files with 3 additions and 122 deletions
@@ -35,7 +35,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -1,36 +0,0 @@
 ---
 # Authoritative masters (replaces the 3x Puppet authoritative servers).
 # pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
  name: auth
  namespace: binddns-auth
 spec:
  mode: authoritative
  replicas: 3
  storageClassName: cephrbd-fast-delete
  storageSize: 2Gi
  service:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: common
      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 512Mi
 ---
 # Catalog zone so new BindZones auto-provision onto the secondaries.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCatalogZone
 metadata:
  name: auth-catalog
  namespace: binddns-auth
 spec:
  clusterRef: auth
  zoneName: catalog.internal
  transferKeyRef: transfer-key
@@ -1,8 +0,0 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - tsigkey.yaml
  - cluster.yaml
@@ -1,5 +0,0 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: binddns-auth
@@ -1,10 +0,0 @@
 ---
 # Zone-transfer / catalog key. The operator generates the material into a
 # Secret (transfer-key-tsig); nothing sensitive is committed to git.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
  name: transfer-key
  namespace: binddns-auth
 spec:
  algorithm: hmac-sha256
@@ -1,26 +0,0 @@
 ---
 # external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
 # authoritative cluster; external-dns writes to its zones via RFC2136 because
 # those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
  name: externaldns
  namespace: binddns-externaldns
 spec:
  mode: authoritative
  replicas: 3
  storageClassName: cephrbd-fast-delete
  storageSize: 1Gi
  service:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: dmz
      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 512Mi
@@ -1,8 +0,0 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
  - tsigkey.yaml
  - cluster.yaml
@@ -1,5 +0,0 @@
 ---
 apiVersion: v1
 kind: Namespace
 metadata:
  name: binddns-externaldns
@@ -1,10 +0,0 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
 # updates to the primary. The operator generates the material into a Secret.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
  name: externaldns-key
  namespace: binddns-externaldns
 spec:
  algorithm: hmac-sha256
@@ -15,6 +15,7 @@ spec:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: common
      purelb.io/addresses: 198.18.200.7
      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
  forwarders:
    - 1.1.1.1
@@ -1,6 +0,0 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/binddns-auth
@@ -1,6 +0,0 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../../../base/binddns-externaldns
Author	SHA1	Message	Date
unkinben	d996722056	Pin binddns-resolver service to a dedicated IP ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.7 (common pool)	2026-07-03 20:19:57 +10:00
unkinben	fab400c15c	Deploy binddns-resolver BIND cluster ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Adds the recursive resolvers (3 identical recursive servers with forwarders). Stacked on the bind-operator deploy so the CRDs and kubeconform schemas are present; merge the operator PR first. - add apps/base/binddns-resolver and its au-syd1 overlay	2026-07-03 19:54:32 +10:00
unkinben	edbb62cca4	Deploy bind-operator (operator + CRDs) ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details Deploys the bind-operator control plane on its own so it can be verified before any DNS clusters are created. The three BIND tiers follow as separate PRs. - add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC, namespace, and CRDs pulled from the operator repo by raw URL - add au-syd1 bind-system overlay - register all four bind apps in the platform ApplicationSet (the DNS overlays are instantiated only once their dirs land in later PRs) - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the CRs	2026-07-03 19:54:09 +10:00
unkinben	bb330a0365	chore(artifactapi): deploy v3.7.4 (#218 ) ## Why artifactapi `v3.7.4` images are built and pushed; au-syd1 is on `v3.7.3`. This rolls forward to ship the terraform provider registry. ## Changes - `api-deployment`: `artifactapi` `v3.7.3` → `v3.7.4` - `ui-deployment`: `artifactapi-ui` `v3.7.3` → `v3.7.4` ## What's new in v3.7.4 - Local terraform repos are now a real provider registry: `/.well-known/terraform.json` + `providers.v1` versions/download with GPG-signed SHA256SUMS (#102). - The signing key self-provisions in the DB (`signing_keys` table) — no K8s secret to mount, so no deployment wiring needed. Once synced, `terraform init` against `source = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"` works. Reviewed-on: #218 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 19:40:38 +10:00