Fix validate-except syntax: trailing semicolon after last entry

named requires every entry in the list to be semicolon-terminated, including the last one before the closing brace; without it named fails config parse (missing ';' before '}') and crash-loops.
Exempt internal split-horizon zones from resolver DNSSEC validation
2026-07-12 22:21:22 +10:00 · 2026-07-12 22:13:50 +10:00
31 changed files with 8 additions and 516 deletions
@@ -24,6 +24,3 @@ spec:
    - 198.18.27.0/24
    - 198.18.28.0/24
    - 198.18.29.0/24
-    # Admin/management access (individual hosts, not whole subnets)
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router
@@ -13,11 +13,9 @@ spec:
  storageSize: 2Gi
  # Restrict queries to internal networks (puppet acl-main.unkin.net).
  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication. localhost is required so the
-  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
-  # without it every dynamic update is "denied due to allow-query".
+  # from the primary during catalog replication.
  extraOptions:
-    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
+    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
  service:
    type: LoadBalancer
    externalTrafficPolicy: Local
@@ -6,5 +6,4 @@ resources:
  - cluster.yaml
  - tsigkey.yaml
  - zones.yaml
-  - records.yaml
  - acls.yaml
@@ -1,64 +0,0 @@
-# Individually-managed authoritative records for the unkin.net zone.
-# DNSRecords must live in the same namespace as their BindZone (the operator
-# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
-# these sit alongside the zone in bind-internal, not in the app namespace.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  # "internal" in the name distinguishes this from the external DNS that
-  # Authentik will manage its own records from later.
-  name: identity-dns-internal
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: identity
-  type: A
-  ttl: 600
-  values:
-    # traefik-internal gateway VIP; the authentik Gateway serves the
-    # identity.unkin.net hostname there.
-    - 198.18.200.4
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: s3-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: s3
-  type: CNAME
-  ttl: 600
-  values:
-    # radosgw S3 endpoint. Points at the Consul service for now; the real
-    # target will be changed later.
-    - radosgw.service.consul.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: dashboard-ceph-cname
-  namespace: bind-internal
-spec:
-  zoneRef: ceph-unkin-net
-  name: dashboard
-  type: CNAME
-  ttl: 600
-  values:
-    # Ceph mgr dashboard, reached via lb1. Lets in-cluster clients (the
-    # cephrgw-operator) resolve dashboard.ceph.unkin.net.
-    - lb1.unkin.net.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: lb1-unkin-net
-  namespace: bind-internal
-spec:
-  zoneRef: unkin-net
-  name: lb1
-  type: A
-  ttl: 600
-  values:
-    - 103.216.191.185
@@ -31,22 +31,6 @@ spec:
  dynamicUpdate: true
  updateKeyRef: client-update
 ---
-# ceph.unkin.net: the ceph host (ausyd1nxvm2069/halb) publishes
-# dashboard.ceph.unkin.net via nsupdate; puppet targets a dedicated
-# `zone ceph.unkin.net.`, so it must exist here or the update gets NOTZONE.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: ceph-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: ceph.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: client-update
---
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindZone
 metadata:
@@ -13,9 +13,6 @@ spec:
    - 198.18.21.160/27
    - 198.18.2.192/27
    - 198.18.21.192/27
-    # Admin/management access
-    - 10.10.12.200/32   # benvin workstation (wireguard)
-    - 198.18.21.160/32  # benvin router (also within 198.18.21.160/27 above)
    - 198.18.13.0/24
    - 198.18.14.0/24
    - 198.18.15.0/24
@@ -13,7 +13,7 @@ metadata:
  name: bind-tsig-api
  namespace: bind-internal
 spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
+  image: git.unkin.net/unkin/bind-tsig-api:v0.2.1
  replicas: 1
  port: 8443
  # targetNamespace defaults to this resource's namespace (bind-internal), where
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.3
+          image: git.unkin.net/unkin/bind-operator:v0.2.1
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -6,6 +6,6 @@ resources:
  - namespace.yaml
  # CRDs are pulled from the bind-operator repo at the matching tag rather than
  # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.3/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.1/config/crd/install.yaml
  - rbac.yaml
  - deployment.yaml
@@ -1,66 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cephrgw-operator
-  namespace: cephrgw-system
-  labels:
-    app.kubernetes.io/name: cephrgw-operator
-  annotations:
-    # Restart the operator when the credentials Secret rotates.
-    reloader.stakater.com/auto: "true"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: cephrgw-operator
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: cephrgw-operator
-    spec:
-      serviceAccountName: cephrgw-operator
-      securityContext:
-        runAsNonRoot: true
-      containers:
-        - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.1.0
-          args:
-            - --metrics-bind-address=:8080
-            - --health-probe-bind-address=:8081
-            - --leader-elect
-          envFrom:
-            # Provides CEPH_DASHBOARD_URL/USERNAME/PASSWORD and, optionally,
-            # CEPH_RGW_ENDPOINT / CEPH_DASHBOARD_CA. Create this Secret per
-            # docs/ceph-setup.md; it is intentionally not managed in GitOps.
-            - secretRef:
-                name: cephrgw-credentials
-          ports:
-            - containerPort: 8080
-              name: metrics
-            - containerPort: 8081
-              name: health
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: 8081
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8081
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
@@ -1,13 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  # CRDs are pulled from the cephrgw-operator repo at the matching tag rather
-  # than vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.1.0/config/crd/install.yaml
-  - rbac.yaml
-  - deployment.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cephrgw-system
@@ -1,38 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cephrgw-operator
-  namespace: cephrgw-system
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cephrgw-operator
-rules:
-  - apiGroups: ["ceph.unkin.net"]
-    resources: ["*"]
-    verbs: ["*"]
-  # The operator delivers RGW access/secret keys into Secrets.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cephrgw-operator
-subjects:
-  - kind: ServiceAccount
-    name: cephrgw-operator
-    namespace: cephrgw-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cephrgw-operator
@@ -1,21 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: cephrgw-system
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cephrgw-system
-  kubernetes:
-    # Shared "default" role: binds the namespace's default ServiceAccount and
-    # grants the templated kv/kubernetes/namespace/<ns>/<sa>/* read policy, so
-    # no per-app terraform-vault change is needed.
-    role: default
-    serviceAccount: default
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600
@@ -1,27 +0,0 @@
---
-# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials
-# Secret the operator Deployment consumes via envFrom. The KV secret's keys
-# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
-# copied verbatim, so they land as the matching env vars.
-#
-# The path sits under the templated default policy
-# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
-# role or policy. Seed the values with:
-#   vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
-#     CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=...
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: cephrgw-credentials
-  namespace: cephrgw-system
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
-  refreshAfter: 5m
-  hmacSecretData: true
-  destination:
-    name: cephrgw-credentials
-    create: true
-    overwrite: true
@@ -51,13 +51,10 @@ spec:
      allow_sign_up: "true"
      use_pkce: "true"
      client_id: "grafana"
-      # ak_groups = hierarchical group claim from terraform-authentik (carries
-      # permission groups inherited via role groups).
-      scopes: "openid email profile ak_groups"
+      scopes: "openid email profile"
      auth_url: "https://identity.unkin.net/application/o/authorize/"
      token_url: "https://identity.unkin.net/application/o/token/"
      api_url: "https://identity.unkin.net/application/o/userinfo/"
-      # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
-      # to akR-global-admin members (and direct members) via terraform-authentik.
-      role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
+      # Authentik groups -> Grafana roles (adjust group name as needed).
+      role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
      role_attribute_strict: "false"
@@ -30,14 +30,6 @@ spec:
            - containerPort: 4000
              name: http
              protocol: TCP
-          env:
-            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
-            # litellm-env ConfigMap.
-            - name: GENERIC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: oauth-credentials
-                  key: client_secret
          envFrom:
            - secretRef:
                name: litellm-credentials
@@ -25,17 +25,5 @@ configMapGenerator:
  - name: litellm-env
    literals:
      - STORE_MODEL_IN_DB=True
-      # Authentik OIDC SSO (generic). Client secret is injected from the
-      # oauth-credentials Secret in the Deployment; endpoints match the other
-      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
-      - GENERIC_CLIENT_ID=litellm
-      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
-      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
-      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
-      # litellm_role scope carries the Authentik-computed role claim; LiteLLM
-      # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
-      - GENERIC_SCOPE=openid email profile litellm_role
-      - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
-      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
    options:
      disableNameSuffixHash: true
@@ -18,24 +18,6 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
-metadata:
-  name: oauth-credentials
-  namespace: litellm
-spec:
-  destination:
-    create: true
-    name: oauth-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  # Same secret Authentik sets on the litellm OAuth2 provider (key: client_secret).
-  path: kubernetes/namespace/litellm/default/oauth-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
 metadata:
  name: litellm-credentials
  namespace: litellm
@@ -10,7 +10,6 @@ resources:
  - serviceaccount_terraform_authentik.yaml
  - serviceaccount_terraform_git.yaml
  - serviceaccount_terraform_prowlarr.yaml
-  - serviceaccount_terraform_rancher.yaml
  - serviceaccount_terraform_radarr.yaml
  - serviceaccount_terraform_sonarr.yaml
  - serviceaccount_terraform_vault.yaml
@@ -1,6 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-rancher
-  namespace: woodpecker
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/cephrgw-system
@@ -18,7 +18,6 @@ spec:
      - path: apps/overlays/*/cattle-system
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
-      - path: apps/overlays/*/cephrgw-system
      - path: apps/overlays/*/cnpg-system
      - path: apps/overlays/*/consul
      - path: apps/overlays/*/elastic-system
@@ -6,23 +6,3 @@ metadata:
  namespace: argocd
 data:
  kustomize.buildOptions: "--enable-helm"
-  # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
-  url: https://argocd.k8s.syd1.au.unkin.net
-  # OIDC login via Authentik. The client secret is seeded in Vault out of band
-  # and surfaced as the `argocd-oidc` Secret (labelled part-of=argocd) by VSO;
-  # `$argocd-oidc:client_secret` resolves the key from that Secret.
-  oidc.config: |
-    name: Authentik
-    issuer: https://identity.unkin.net/application/o/argocd/
-    clientID: argocd
-    clientSecret: $argocd-oidc:client_secret
-    requestedScopes:
-      - openid
-      - profile
-      - email
-      # Hierarchical group claim from terraform-authentik (includes permission
-      # groups inherited via role groups). Read for RBAC below.
-      - ak_groups
-    requestedIDTokenClaims:
-      ak_groups:
-        essential: true
@@ -1,10 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cmd-params-cm
-  namespace: argocd
-data:
-  # argocd-server serves plain HTTP; TLS is terminated at the traefik-internal
-  # gateway in front of it. Required so the gateway can route to port 80.
-  server.insecure: "true"
@@ -1,18 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: argocd
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - argocd
-  kubernetes:
-    role: default
-    serviceAccount: default
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600
@@ -1,23 +0,0 @@
---
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: argocd-oidc
-  namespace: argocd
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  # Seeded out of band; same secret is read by terraform-authentik to configure
-  # the provider's client_secret. Key: client_secret.
-  path: kubernetes/namespace/argocd/default/oauth-credentials
-  refreshAfter: 5m
-  hmacSecretData: true
-  destination:
-    name: argocd-oidc
-    create: true
-    overwrite: true
-    # ArgoCD only resolves `$secret:key` references against Secrets carrying
-    # this label.
-    labels:
-      app.kubernetes.io/part-of: argocd
@@ -1,16 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-rbac-cm
-  namespace: argocd
-data:
-  # Match RBAC subjects against the hierarchical `ak_groups` claim from Authentik
-  # (carries permission groups inherited via role groups).
-  scopes: "[ak_groups]"
-  # Authenticated users with no matching group get read-only access.
-  policy.default: role:readonly
-  # Authentik permission group -> ArgoCD role. akP-argocd-admin is granted to
-  # akR-global-admin members (and direct members) via terraform-authentik.
-  policy.csv: |
-    g, akP-argocd-admin, role:admin
@@ -1,39 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: argocd-server
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: argocd-server
-    app.kubernetes.io/instance: argocd
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: argocd.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: argocd.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.4
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - name: http
-      port: 80
-      protocol: HTTP
-      hostname: argocd.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      port: 443
-      protocol: HTTPS
-      hostname: argocd.k8s.syd1.au.unkin.net
-      allowedRoutes:
-        namespaces:
-          from: Same
-      tls:
-        mode: Terminate
-        certificateRefs:
-          - group: ""
-            kind: Secret
-            name: argocd-server-tls
@@ -1,55 +0,0 @@
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd-server-http-redirect
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: argocd-server
-    app.kubernetes.io/instance: argocd
-spec:
-  hostnames:
-    - argocd.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: argocd-server
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
---
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd-server
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: argocd-server
-    app.kubernetes.io/instance: argocd
-spec:
-  hostnames:
-    - argocd.k8s.syd1.au.unkin.net
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: argocd-server
-      sectionName: https
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: argocd-server
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
@@ -7,25 +7,12 @@ resources:
  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
  - au-syd1-apps.yaml
  - argocd-self-app.yaml
-  # Authentik OIDC: expose argocd-server and wire the client secret from Vault.
-  - argocd-server-gateway.yaml
-  - argocd-server-httproute.yaml
-  - argocd-oidc-vaultauth.yaml
-  - argocd-oidc-vaultstaticsecret.yaml

 patches:
  - path: argocd-cm-patch.yaml
    target:
      kind: ConfigMap
      name: argocd-cm
-  - path: argocd-rbac-cm-patch.yaml
-    target:
-      kind: ConfigMap
-      name: argocd-rbac-cm
-  - path: argocd-cmd-params-cm-patch.yaml
-    target:
-      kind: ConfigMap
-      name: argocd-cmd-params-cm
  - path: argocd-tls-certs-patch.yaml
    target:
      kind: ConfigMap