Pin binddns-resolver service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.7 (common pool)
Deploy binddns-resolver BIND cluster
2026-07-03 20:29:19 +10:00 · 2026-07-03 20:29:19 +10:00 · 2026-07-03 20:04:57 +10:00 · 2026-07-03 19:40:38 +10:00
13 changed files with 3 additions and 122 deletions
@@ -35,7 +35,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.3
+          image: git.unkin.net/unkin/artifactapi:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -1,36 +0,0 @@
---
-# Authoritative masters (replaces the 3x Puppet authoritative servers).
-# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: auth
-  namespace: binddns-auth
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 2Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
---
-# Catalog zone so new BindZones auto-provision onto the secondaries.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: auth-catalog
-  namespace: binddns-auth
-spec:
-  clusterRef: auth
-  zoneName: catalog.internal
-  transferKeyRef: transfer-key
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - tsigkey.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-auth
@@ -1,10 +0,0 @@
---
-# Zone-transfer / catalog key. The operator generates the material into a
-# Secret (transfer-key-tsig); nothing sensitive is committed to git.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: transfer-key
-  namespace: binddns-auth
-spec:
-  algorithm: hmac-sha256
@@ -1,26 +0,0 @@
---
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: externaldns
-  namespace: binddns-externaldns
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: dmz
-      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - tsigkey.yaml
-  - cluster.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: binddns-externaldns
@@ -1,10 +0,0 @@
---
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: binddns-externaldns
-spec:
-  algorithm: hmac-sha256
@@ -15,6 +15,7 @@ spec:
    type: LoadBalancer
    annotations:
      purelb.io/service-group: common
+      purelb.io/addresses: 198.18.200.7
      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
  forwarders:
    - 1.1.1.1
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-auth
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/binddns-externaldns
Author	SHA1	Message	Date
unkinben	fda91c773d	Pin binddns-resolver service to a dedicated IP ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.7 (common pool)	2026-07-03 20:29:19 +10:00
unkinben	475df18244	Deploy binddns-resolver BIND cluster Adds the recursive resolvers (3 identical recursive servers with forwarders). Stacked on the bind-operator deploy so the CRDs and kubeconform schemas are present; merge the operator PR first. - add apps/base/binddns-resolver and its au-syd1 overlay	2026-07-03 20:29:19 +10:00
unkinben	4b8f9313c8	Deploy bind-operator (operator + CRDs) (#219 ) First of a 4-PR split of the bind rollout (was #216). Deploys just the operator control plane so it can be verified before any DNS clusters exist. ## Why Roll out incrementally: operator + CRDs first, then each BIND tier as its own PR. ## Changes - `apps/base/bind-system`: operator Deployment (`git.unkin.net/unkin/bind-operator:v0.1.1`), RBAC, namespace; CRDs pulled from the operator repo by raw URL (`config/crd/install.yaml` @ v0.1.1) - au-syd1 `bind-system` overlay - register all four bind apps in `argocd/applicationsets/platform.yaml` (DNS overlays instantiate only when their dirs land in the follow-up PRs) - add `binddns-` namespaces to `argocd/projects/platform.yaml` - add `schemas/bind.unkin.net/.json` for kubeconform ## Deploy impact Operator pod + CRDs only. No DNS services yet — the operator is idle until BindClusters exist. ## Follow-ups (merge after this) binddns-auth, binddns-resolver, binddns-externaldns — one PR each. Reviewed-on: #219 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 20:04:57 +10:00
unkinben	bb330a0365	chore(artifactapi): deploy v3.7.4 (#218 ) ## Why artifactapi `v3.7.4` images are built and pushed; au-syd1 is on `v3.7.3`. This rolls forward to ship the terraform provider registry. ## Changes - `api-deployment`: `artifactapi` `v3.7.3` → `v3.7.4` - `ui-deployment`: `artifactapi-ui` `v3.7.3` → `v3.7.4` ## What's new in v3.7.4 - Local terraform repos are now a real provider registry: `/.well-known/terraform.json` + `providers.v1` versions/download with GPG-signed SHA256SUMS (#102). - The signing key self-provisions in the DB (`signing_keys` table) — no K8s secret to mount, so no deployment wiring needed. Once synced, `terraform init` against `source = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"` works. Reviewed-on: #218 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-03 19:40:38 +10:00