Pull bind CRDs from operator repo instead of vendoring

References the CRD bundle from the bind-operator repo by a stable raw URL
so the CRDs never drift from the operator, matching how other apps import
upstream manifests.

- replace the nine vendored crds/*.yaml with a single remote resource:
  git.unkin.net/unkin/bind-operator raw config/crd/install.yaml at v0.1.1
- bump the operator image to v0.1.1 so the running operator and its CRDs
  come from the same tag

apps/base/artifactapi/api-deployment.yaml

@@ -35,7 +35,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: git.unkin.net/unkin/artifactapi:v3.7.4
+          image: git.unkin.net/unkin/artifactapi:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: git.unkin.net/unkin/artifactapi-ui:v3.7.4
+          image: git.unkin.net/unkin/artifactapi-ui:v3.7.3
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.1.2
+          image: git.unkin.net/unkin/bind-operator:v0.1.1
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/binddns-auth/cluster.yaml

@@ -5,7 +5,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: auth
-  namespace: ns-auth
+  namespace: binddns-auth
 spec:
   mode: authoritative
   replicas: 3
@@ -15,7 +15,6 @@ spec:
     type: LoadBalancer
     annotations:
       purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.6
       external-dns.alpha.kubernetes.io/hostname: ns-auth.k8s.syd1.au.unkin.net
   resources:
     requests:
@@ -30,7 +29,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCatalogZone
 metadata:
   name: auth-catalog
-  namespace: ns-auth
+  namespace: binddns-auth
 spec:
   clusterRef: auth
   zoneName: catalog.internal

apps/base/binddns-auth/kustomization.yaml

@@ -6,4 +6,3 @@ resources:
   - namespace.yaml
   - tsigkey.yaml
   - cluster.yaml
-  - zones.yaml

apps/base/binddns-auth/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: ns-resolver
+  name: binddns-auth

apps/base/binddns-auth/tsigkey.yaml

@@ -5,6 +5,6 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
   name: transfer-key
-  namespace: ns-auth
+  namespace: binddns-auth
 spec:
   algorithm: hmac-sha256

apps/base/binddns-externaldns/cluster.yaml

@@ -6,7 +6,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: externaldns
-  namespace: ns-externaldns
+  namespace: binddns-externaldns
 spec:
   mode: authoritative
   replicas: 3
@@ -15,9 +15,8 @@ spec:
   service:
     type: LoadBalancer
     annotations:
-      purelb.io/service-group: common
+      purelb.io/service-group: dmz
-      purelb.io/addresses: 198.18.200.8
+      external-dns.alpha.kubernetes.io/hostname: ns-ext.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/hostname: ns-externaldns.k8s.syd1.au.unkin.net
   resources:
     requests:
       cpu: 100m
@@ -25,15 +24,3 @@ spec:
     limits:
       cpu: "1"
       memory: 512Mi
----
-# Catalog zone so the dynamic zones replicate onto the cluster's secondaries
-# (external-dns writes to the primary; secondaries IXFR the result).
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindCatalogZone
-metadata:
-  name: externaldns-catalog
-  namespace: ns-externaldns
-spec:
-  clusterRef: externaldns
-  zoneName: catalog.externaldns.internal
-  transferKeyRef: externaldns-key

apps/base/binddns-externaldns/kustomization.yaml

@@ -6,4 +6,3 @@ resources:
   - namespace.yaml
   - tsigkey.yaml
   - cluster.yaml
-  - zones.yaml

apps/base/binddns-externaldns/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: ns-auth
+  name: binddns-externaldns

apps/base/binddns-externaldns/tsigkey.yaml

@@ -5,6 +5,6 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
   name: externaldns-key
-  namespace: ns-externaldns
+  namespace: binddns-externaldns
 spec:
   algorithm: hmac-sha256

apps/base/binddns-resolver/cluster.yaml

@@ -5,7 +5,7 @@ apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: resolver
-  namespace: ns-resolver
+  namespace: binddns-resolver
 spec:
   mode: resolver
   replicas: 3
@@ -15,8 +15,7 @@ spec:
     type: LoadBalancer
     annotations:
       purelb.io/service-group: common
-      purelb.io/addresses: 198.18.200.7
+      external-dns.alpha.kubernetes.io/hostname: resolver.k8s.syd1.au.unkin.net
-      external-dns.alpha.kubernetes.io/hostname: ns-resolver.k8s.syd1.au.unkin.net
   forwarders:
     - 1.1.1.1
     - 9.9.9.9

apps/base/binddns-resolver/namespace.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: ns-externaldns
+  name: binddns-resolver

apps/base/ns-auth/zones.yaml

@@ -1,204 +0,0 @@
-# Authoritative zones migrated from puppet-prod
-# (profiles::dns::master::zones in hieradata/roles/infra/dns/master.yaml).
-# type primary, static (puppet dynamic:false); TTL 600 as in the puppet zone header.
-# Record data is populated by PuppetDB exported resources upstream, so it is
-# NOT in this repo — migrate it into these zones (AXFR from the current masters,
-# or DNSRecord CRs) as a follow-up. The zones start with SOA+NS only.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: unkin-net
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: unkin.net
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 13-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 13.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 14-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 14.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 15-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 15.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 16-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 16.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 17-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 17.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 19-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 19.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 20-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 20.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 21-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 21.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 22-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 22.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 23-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 23.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 24-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 24.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 25-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 25.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 26-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 26.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 27-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 27.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 28-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 28.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 29-18-198-in-addr-arpa
-  namespace: ns-auth
-spec:
-  clusterRef: auth
-  zoneName: 29.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600

apps/base/ns-externaldns/zones.yaml

@@ -1,34 +0,0 @@
-# k8s external-dns zones migrated from puppet-prod
-# (externaldns::k8s_zones in hieradata/roles/infra/dns/externaldns.yaml).
-# Primary + dynamicUpdate: the Kubernetes external-dns controller writes
-# records here via RFC2136 authenticated with externaldns-key.
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: k8s-syd1-au-unkin-net
-  namespace: ns-externaldns
-spec:
-  clusterRef: externaldns
-  zoneName: k8s.syd1.au.unkin.net
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key
----
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: 200-18-198-in-addr-arpa
-  namespace: ns-externaldns
-spec:
-  clusterRef: externaldns
-  zoneName: 200.18.198.in-addr.arpa
-  type: primary
-  defaultTTL: 600
-  dynamicUpdate: true
-  updateKeyRef: externaldns-key
-  allowTransfer:
-    - key externaldns-key

apps/overlays/au-syd1/binddns-auth/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/ns-resolver
+  - ../../../base/binddns-auth

apps/overlays/au-syd1/binddns-externaldns/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/ns-externaldns
+  - ../../../base/binddns-externaldns

apps/overlays/au-syd1/binddns-resolver/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/ns-auth
+  - ../../../base/binddns-resolver

argocd/applicationsets/platform.yaml

@@ -13,9 +13,9 @@ spec:
       - path: apps/overlays/*/authentik
       - path: apps/overlays/*/artifactapi
       - path: apps/overlays/*/bind-system
-      - path: apps/overlays/*/ns-auth
+      - path: apps/overlays/*/binddns-auth
-      - path: apps/overlays/*/ns-resolver
+      - path: apps/overlays/*/binddns-resolver
-      - path: apps/overlays/*/ns-externaldns
+      - path: apps/overlays/*/binddns-externaldns
       - path: apps/overlays/*/age-api
       - path: apps/overlays/*/cattle-system
       - path: apps/overlays/*/cert-manager

argocd/projects/platform.yaml

@@ -21,11 +21,11 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'authentik'
       server: https://kubernetes.default.svc
-    - namespace: 'ns-auth'
+    - namespace: 'binddns-auth'
       server: https://kubernetes.default.svc
-    - namespace: 'ns-resolver'
+    - namespace: 'binddns-resolver'
       server: https://kubernetes.default.svc
-    - namespace: 'ns-externaldns'
+    - namespace: 'binddns-externaldns'
       server: https://kubernetes.default.svc
     - namespace: 'cert-manager'
       server: https://kubernetes.default.svc