Fix validate-except syntax: trailing semicolon after last entry

named requires every entry in the list to be semicolon-terminated, including the last one before the closing brace; without it named fails config parse (missing ';' before '}') and crash-loops.
Exempt internal split-horizon zones from resolver DNSSEC validation
2026-07-12 22:21:22 +10:00 · 2026-07-12 22:13:50 +10:00
1 changed files with 9 additions and 0 deletions
@@ -21,6 +21,15 @@ spec:
  forwarders:
    - 8.8.8.8
    - 1.1.1.1
  # The internal split-horizon zones are served UNSIGNED by the in-cluster
  # authoritative, but their public parents publish DS records (e.g. unkin.net
  # is DNSSEC-signed on the Internet). With dnssec-validation on, the validator
  # sees "parent indicates secure" but gets an insecure answer and returns
  # SERVFAIL (broken trust chain). Treat the forwarded internal domains as
  # insecure so they are not validated. unkin.net covers all *.unkin.net
  # (incl. k8s.syd1.au.unkin.net); 18.198.in-addr.arpa covers every reverse zone.
  extraOptions:
    - "validate-except { unkin.net; 18.198.in-addr.arpa; consul; }"
  resources:
    requests:
      cpu: 20m