unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Bump bind-operator to v0.2.0 and deploy companion TSIG API #249

Merged
benvin merged 1 commits from benvin/bind-operator-0.2.0 into main 2026-07-12 19:12:39 +10:00
Conversation 0 Commits 1 Files Changed 7
+252 -3
unkinben commented 2026-07-12 19:11:07 +10:00
Owner
Copy Link
Copy Source

Why

bind-operator v0.2.0 adds the BindTSIGAPI CRD and a companion API that vault-plugin-secrets-bind-tsig calls to create, rotate and delete TSIG keys (it does so by managing BindTSIGKey resources, which the operator reconciles into key material). This rolls the operator forward and deploys an API instance so Vault never talks to the Kubernetes API directly.

Changes

  • Bump the operator image (bind-system/deployment.yaml) and the pulled CRD bundle URL (bind-system/kustomization.yaml) to v0.2.0.
  • Broaden the operator ClusterRole (bind-system/rbac.yaml) with deployments, serviceaccounts and roles/rolebindings, so the BindTSIGAPI reconciler can create the API Deployment and its namespaced Role/RoleBinding.
  • Add a BindTSIGAPI (bind-tsig-api) in bind-internal; the operator reconciles it into a Deployment, Service, ConfigMap, master-token Secret and RBAC. Keys are created in bind-internal, alongside the authoritative cluster and its existing keys.
  • Add the generated kubeconform schema for BindTSIGAPI.

Notes

  • The master access token Secret (bind-tsig-api-token) is generated by the operator when absent; the operator does not own it, so a VaultStaticSecret can later pre-seed/overwrite it to source the token from Vault.
  • Validated: both overlays render (kubectl kustomize) and pass kubeconform (bind-internal 56/56 valid); pre-commit clean.

Follow-up

  • Point vault-plugin-secrets-bind-tsig config at http://bind-tsig-api.bind-internal.svc:8443.
## Why bind-operator v0.2.0 adds the `BindTSIGAPI` CRD and a companion API that `vault-plugin-secrets-bind-tsig` calls to create, rotate and delete TSIG keys (it does so by managing `BindTSIGKey` resources, which the operator reconciles into key material). This rolls the operator forward and deploys an API instance so Vault never talks to the Kubernetes API directly. ## Changes - Bump the operator image (`bind-system/deployment.yaml`) and the pulled CRD bundle URL (`bind-system/kustomization.yaml`) to `v0.2.0`. - Broaden the operator ClusterRole (`bind-system/rbac.yaml`) with `deployments`, `serviceaccounts` and `roles`/`rolebindings`, so the `BindTSIGAPI` reconciler can create the API Deployment and its namespaced Role/RoleBinding. - Add a `BindTSIGAPI` (`bind-tsig-api`) in `bind-internal`; the operator reconciles it into a Deployment, Service, ConfigMap, master-token Secret and RBAC. Keys are created in `bind-internal`, alongside the authoritative cluster and its existing keys. - Add the generated kubeconform schema for `BindTSIGAPI`. ## Notes - The master access token Secret (`bind-tsig-api-token`) is generated by the operator when absent; the operator does not own it, so a `VaultStaticSecret` can later pre-seed/overwrite it to source the token from Vault. - Validated: both overlays render (`kubectl kustomize`) and pass `kubeconform` (bind-internal 56/56 valid); pre-commit clean. ## Follow-up - Point `vault-plugin-secrets-bind-tsig` config at `http://bind-tsig-api.bind-internal.svc:8443`.
unkinben added 1 commit 2026-07-12 19:11:07 +10:00
Bump bind-operator to v0.2.0 and deploy companion TSIG API
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
3b4620ade4 
v0.2.0 adds the BindTSIGAPI CRD and companion API that
vault-plugin-secrets-bind-tsig calls to create, rotate and delete TSIG
keys. This rolls the operator forward and deploys an API instance.

- Bump the operator image and the pulled CRD bundle to v0.2.0.
- Broaden the operator ClusterRole with deployments, serviceaccounts and
  roles/rolebindings so the BindTSIGAPI reconciler can deploy the API and
  its namespaced RBAC.
- Add a BindTSIGAPI (bind-tsig-api) in bind-internal; the operator
  reconciles it into a Deployment, Service, ConfigMap, master-token Secret
  and RBAC. Keys are created in bind-internal alongside the authoritative
  cluster.
- Add the generated kubeconform schema for BindTSIGAPI.
benvin merged commit 38ef6c4a09 into main 2026-07-12 19:12:39 +10:00
benvin deleted branch benvin/bind-operator-0.2.0 2026-07-12 19:12:40 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#249
Delete Branch "benvin/bind-operator-0.2.0"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?