Bump bind-operator to v0.2.1 (secondary replication fix) #250

2026-07-12T21:38:45+10:00

unkinben commented

2026-07-12 21:38:45 +10:00

Why

v0.2.1 fixes authoritative secondary replication, which never actually worked — the master REFUSED the catalog AXFR. Root causes (bind-operator #9): secondaries presented no TSIG key, member zones had no allow-transfer, and secondaries pointed at the primary's ephemeral pod IP.

Changes

Bump the operator image (bind-system/deployment.yaml) and the pulled CRD bundle URL (bind-system/kustomization.yaml) to v0.2.1.
Bump the bind-tsig-api image (bind-internal/tsig-api/tsig-api.yaml) to v0.2.1.

CRDs are unchanged from v0.2.0, so the generated kubeconform schemas need no update.

Validation

bind-system renders with the v0.2.1 CRD bundle; bind-internal passes kubeconform (56/56); pre-commit clean.

Deploy note

Existing member zones pick up allow-transfer via modzone, and secondaries re-point at the stable primary Service ClusterIP with the transfer key, restoring replication without manual BIND surgery. A from-scratch namespace recreate also comes up clean (OrderedReady startup means secondaries snapshot a ClusterIP-correct config). Caveat for a full recreate: the operator regenerates the client-update TSIG key, so its new material must be re-synced into puppet eyaml before clients can nsupdate.

## Why v0.2.1 fixes authoritative **secondary replication**, which never actually worked — the master REFUSED the catalog AXFR. Root causes (bind-operator #9): secondaries presented no TSIG key, member zones had no `allow-transfer`, and secondaries pointed at the primary's ephemeral pod IP. ## Changes - Bump the operator image (`bind-system/deployment.yaml`) and the pulled CRD bundle URL (`bind-system/kustomization.yaml`) to `v0.2.1`. - Bump the `bind-tsig-api` image (`bind-internal/tsig-api/tsig-api.yaml`) to `v0.2.1`. CRDs are unchanged from v0.2.0, so the generated kubeconform schemas need no update. ## Validation - `bind-system` renders with the v0.2.1 CRD bundle; `bind-internal` passes `kubeconform` (56/56); pre-commit clean. ## Deploy note Existing member zones pick up `allow-transfer` via `modzone`, and secondaries re-point at the stable primary Service ClusterIP with the transfer key, restoring replication without manual BIND surgery. A from-scratch namespace recreate also comes up clean (OrderedReady startup means secondaries snapshot a ClusterIP-correct config). Caveat for a full recreate: the operator regenerates the `client-update` TSIG key, so its new material must be re-synced into puppet eyaml before clients can nsupdate.

unkinben added 1 commit 2026-07-12 21:38:46 +10:00

Bump bind-operator to v0.2.1 (secondary replication fix)

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

8ac2a23551

v0.2.1 fixes authoritative secondary replication, which never worked:
the master REFUSED the catalog AXFR because secondaries presented no TSIG
key, member zones had no allow-transfer, and secondaries chased the
primary's ephemeral pod IP.

- Bump the operator image and the pulled CRD bundle to v0.2.1.
- Bump the bind-tsig-api image to v0.2.1.

CRDs are unchanged from v0.2.0, so the generated schemas need no update.

benvin merged commit 65f18a6380 into main

2026-07-12 21:43:03 +10:00

benvin deleted branch benvin/bind-operator-0.2.1

2026-07-12 21:43:03 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#250