Pin binddns-resolver service to a dedicated IP

DNS (UDP/53) can't route via a shared gateway yet (no UDPRoute), so the service needs its own LoadBalancer address instead of a pool-assigned one. - pin purelb.io/addresses 198.18.200.7 (common pool)
Deploy binddns-resolver BIND cluster
2026-07-03 20:29:19 +10:00 · 2026-07-03 20:29:19 +10:00
23 changed files with 17 additions and 828 deletions
@@ -1,26 +0,0 @@
---
-# Internal client networks allowed to query the authoritative servers,
-# mirrored from the puppet authoritative /etc/named/acls.conf
-# (acl-main.unkin.net). Named auth-acl-main because the resolver has its own,
-# differently-scoped acl-main.unkin.net in the same namespace.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: auth-acl-main
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  entries:
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.24.0/24
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
@@ -1,49 +0,0 @@
---
-# Authoritative masters (replaces the 3x Puppet authoritative servers).
-# pod-0 is the primary; pods 1-2 replicate via the catalog zone + AXFR/IXFR.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-authoritative
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 2Gi
-  # Restrict queries to internal networks (puppet acl-main.unkin.net).
-  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication.
-  extraOptions:
-    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.6
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net
-  primaryService:
-    type: LoadBalancer
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.9
-      external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
---
-# Catalog zone so new BindZones auto-provision onto the secondaries.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-authoritative-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: catalog.internal
-  transferKeyRef: transfer-key
@@ -1,9 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - tsigkey.yaml
-  - zones.yaml
-  - acls.yaml
@@ -1,11 +0,0 @@
---
-# Zone-transfer / catalog key. The operator generates the material into a
-# Secret (transfer-key-tsig); nothing sensitive is committed to git.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: transfer-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  algorithm: hmac-sha256
@@ -1,204 +0,0 @@
-# Authoritative zones migrated from puppet-prod
-# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
-# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
-# Record data is populated by PuppetDB exported resources upstream, so it is
-# NOT in this repo — migrate it into these zones (AXFR from the current masters,
-# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: unkin.net
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 13.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 14.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 15.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 16.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 17.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 19.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 20.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 21.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 22.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 23.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 24.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 25.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 26.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 27.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 28.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-authoritative
-  zoneName: 29.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
@@ -1,42 +0,0 @@
---
-# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
-# authoritative cluster; external-dns writes to its zones via RFC2136 because
-# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCluster
-metadata:
-  name: bind-externaldns
-  namespace: bind-internal
-spec:
-  mode: authoritative
-  replicas: 3
-  storageClassName: cephrbd-fast-delete
-  storageSize: 1Gi
-  service:
-    type: LoadBalancer
-    externalTrafficPolicy: Local
-    annotations:
-      purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.8
-      external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net
-  primaryService:
-    type: ClusterIP
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: "1"
-      memory: 512Mi
---
-# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
-# (external-dns writes to the primary; secondaries IXFR the result).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: bind-externaldns-catalog
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: catalog.externaldns.internal
-  transferKeyRef: externaldns-key
@@ -1,11 +0,0 @@
---
-# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindTSIGKey
-metadata:
-  name: externaldns-key
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  algorithm: hmac-sha256
@@ -1,34 +0,0 @@
-# k8s external-dns zones migrated from puppet-prod
-# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
-# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
-# records here via RFC2136 authenticated with externaldns-key.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: k8s.syd1.au.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 200-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-externaldns
-  zoneName: 200.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key
@@ -1,9 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - authoritative
-  - resolvers
-  - externaldns
@@ -1,65 +0,0 @@
-# Internal client ACLs, mirrored from puppet /etc/named/acls.conf.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-main.unkin.net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.1.10/32
-    - 198.18.2.160/27
-    - 198.18.21.160/27
-    - 198.18.2.192/27
-    - 198.18.21.192/27
-    - 198.18.13.0/24
-    - 198.18.14.0/24
-    - 198.18.15.0/24
-    - 198.18.16.0/24
-    - 198.18.17.0/24
-    - 198.18.18.0/24
-    - 198.18.19.0/24
-    - 198.18.20.0/24
-    - 198.18.21.0/24
-    - 198.18.22.0/24
-    - 198.18.23.0/24
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-dmz
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.24.0/24
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-common
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.25.0/24
-    - 198.18.26.0/24
-    - 198.18.27.0/24
-    - 198.18.28.0/24
-    - 198.18.29.0/24
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindACL
-metadata:
-  name: acl-nomad-jobs
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  entries:
-    - 198.18.64.0/24
-    - 198.18.65.0/24
-    - 198.18.66.0/24
-    - 198.18.67.0/24
-    - 198.18.68.0/24
-    - 198.18.69.0/24
@@ -1,284 +0,0 @@
-# Conditional forward zones, from the puppet openforwarder view.
-# Upstreams: unkin authoritative 198.18.200.6, consul 198.18.19.14, k8s 198.18.200.8.
-# k8s -> in-cluster bind-externaldns 198.18.200.8.
-# (Zones that forwarded to 10.10.16.x were dropped; consul left as-is.)
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-main-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: main.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-consul
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: consul
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.19.14
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-k8s-syd1-au-unkin-net
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: k8s.syd1.au.unkin.net
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.8
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-13-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 13.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-14-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 14.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-15-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 15.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-16-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 16.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-17-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 17.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-19-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 19.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-20-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 20.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-21-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 21.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-22-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 22.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-23-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 23.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-24-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 24.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-25-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 25.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-26-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 26.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-27-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 27.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-28-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 28.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: fwd-29-18-198-in-addr-arpa
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  viewRef: openforwarder
-  zoneName: 29.18.198.in-addr.arpa
-  type: forward
-  catalog: false
-  forwarders:
-    - 198.18.200.6
@@ -1,9 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cluster.yaml
-  - acls.yaml
-  - view.yaml
-  - forward-zones.yaml
@@ -1,23 +0,0 @@
---
-# openforwarder view, mirrored from puppet /etc/named/views.conf.
-# match-clients gates access to internal networks; recursion/query are 'any'
-# within the view since match-clients already restricts who reaches it.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindView
-metadata:
-  name: openforwarder
-  namespace: bind-internal
-spec:
-  clusterRef: bind-resolvers
-  order: 100
-  matchClients:
-    - acl-main.unkin.net
-    - acl-nomad-jobs
-    - acl-common
-    - acl-dmz
-  recursion: true
-  allowQuery:
-    - any
-  extraOptions:
-    - "allow-recursion { any; }"
-    - "allow-query-cache { any; }"
@@ -21,7 +21,7 @@ spec:
        runAsNonRoot: true
      containers:
        - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.1.5
+          image: git.unkin.net/unkin/bind-operator:v0.1.1
          args:
            - --metrics-bind-address=:8080
            - --health-probe-bind-address=:8081
@@ -6,6 +6,6 @@ resources:
  - namespace.yaml
  # CRDs are pulled from the bind-operator repo at the matching tag rather than
  # vendored here, so they never drift from the operator.
-  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.5/config/crd/install.yaml
+  - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.1/config/crd/install.yaml
  - rbac.yaml
  - deployment.yaml
@@ -4,8 +4,8 @@
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
-  name: bind-resolvers
-  namespace: bind-internal
+  name: resolver
+  namespace: binddns-resolver
 spec:
  mode: resolver
  replicas: 3
@@ -13,14 +13,13 @@ spec:
  storageSize: 1Gi
  service:
    type: LoadBalancer
-    externalTrafficPolicy: Local
    annotations:
      purelb.io/service-group: common
      purelb.io/addresses: 198.18.200.7
-      external-dns.alpha.kubernetes.io/hostname: bind-resolvers.k8s.syd1.au.unkin.net
+      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
  forwarders:
-    - 8.8.8.8
    - 1.1.1.1
+    - 9.9.9.9
  resources:
    requests:
      cpu: 100m
@@ -3,6 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
+  - namespace.yaml
  - cluster.yaml
-  - tsigkey.yaml
-  - zones.yaml
@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: bind-internal
+  name: binddns-resolver
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - ../../../base/bind-internal
+  - ../../../base/binddns-resolver
@@ -13,7 +13,9 @@ spec:
      - path: apps/overlays/*/authentik
      - path: apps/overlays/*/artifactapi
      - path: apps/overlays/*/bind-system
-      - path: apps/overlays/*/bind-internal
+      - path: apps/overlays/*/binddns-auth
+      - path: apps/overlays/*/binddns-resolver
+      - path: apps/overlays/*/binddns-externaldns
      - path: apps/overlays/*/age-api
      - path: apps/overlays/*/cattle-system
      - path: apps/overlays/*/cert-manager
@@ -21,7 +21,11 @@ spec:
      server: https://kubernetes.default.svc
    - namespace: 'authentik'
      server: https://kubernetes.default.svc
-    - namespace: 'bind-internal'
+    - namespace: 'binddns-auth'
+      server: https://kubernetes.default.svc
+    - namespace: 'binddns-resolver'
+      server: https://kubernetes.default.svc
+    - namespace: 'binddns-externaldns'
      server: https://kubernetes.default.svc
    - namespace: 'cert-manager'
      server: https://kubernetes.default.svc
@@ -692,35 +692,6 @@
          },
          "type": "object"
        },
-        "primaryService": {
-          "properties": {
-            "annotations": {
-              "additionalProperties": {
-                "type": "string"
-              },
-              "type": "object"
-            },
-            "externalTrafficPolicy": {
-              "enum": [
-                "Cluster",
-                "Local"
-              ],
-              "type": "string"
-            },
-            "loadBalancerIP": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "ClusterIP",
-                "LoadBalancer",
-                "NodePort"
-              ],
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
        "recursion": {
          "type": "boolean"
        },
@@ -794,13 +765,6 @@
              },
              "type": "object"
            },
-            "externalTrafficPolicy": {
-              "enum": [
-                "Cluster",
-                "Local"
-              ],
-              "type": "string"
-            },
            "loadBalancerIP": {
              "type": "string"
            },
@@ -24,9 +24,6 @@
          ],
          "type": "string"
        },
-        "clusterRef": {
-          "type": "string"
-        },
        "importExisting": {
          "type": "boolean"
        },