Add identity.unkin.net internal DNS record #256

Merged

benvin merged 1 commits from benvin/identity-dns-internal into main 2026-07-15 20:53:40 +10:00

Conversation 0 Commits 1 Files Changed 2

+22

unkinben commented 2026-07-15 07:46:20 +10:00

Owner

Copy Link

Copy Source

Why

identity.unkin.net is configured as the Authentik OIDC issuer but has no DNS record anywhere, so in-cluster OIDC discovery fails (e.g. argocd-server → lookup identity.unkin.net ... no such host). Add an authoritative A record served by the internal bind system (bind-operator) so it resolves.

Change

• New DNSRecord/identity-dns-internal → 198.18.200.4 (the traefik-internal gateway VIP, where the Authentik Gateway serves the identity.unkin.net hostname), in the unkin-net zone.
• Lives in the bind-internal namespace alongside the BindZone: the operator resolves zoneRef/clusterRef/updateKeyRef within the record's own namespace, so it can't live in the app (authentik) namespace.
• Wired into apps/base/bind-internal/authoritative/kustomization.yaml.
• identity-dns-internal name distinguishes this from the external DNS that Authentik will manage its own records from later.

Validation

kustomize build apps/base/bind-internal + kubeconform (validates against the dnsrecord_v1alpha1 schema): 57 valid, 0 invalid. pre-commit clean.

## Why `identity.unkin.net` is configured as the Authentik OIDC issuer but has **no DNS record anywhere**, so in-cluster OIDC discovery fails (e.g. `argocd-server` → `lookup identity.unkin.net ... no such host`). Add an authoritative A record served by the internal bind system (bind-operator) so it resolves. ## Change - New `DNSRecord/identity-dns-internal` → `198.18.200.4` (the traefik-internal gateway VIP, where the Authentik Gateway serves the `identity.unkin.net` hostname), in the `unkin-net` zone. - Lives in the **`bind-internal` namespace** alongside the `BindZone`: the operator resolves `zoneRef`/`clusterRef`/`updateKeyRef` within the record's own namespace, so it can't live in the app (authentik) namespace. - Wired into `apps/base/bind-internal/authoritative/kustomization.yaml`. - `identity-dns-internal` name distinguishes this from the external DNS that Authentik will manage its own records from later. ## Validation `kustomize build apps/base/bind-internal` + kubeconform (validates against the `dnsrecord_v1alpha1` schema): 57 valid, 0 invalid. pre-commit clean.

unkinben added 1 commit 2026-07-15 07:46:20 +10:00

Add identity.unkin.net internal DNS record ... 4163bf80b3

identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS
record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to
resolve it. Add an authoritative A record via the bind-operator so the
internal bind system serves it.

- New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP,
  where the authentik Gateway serves the identity.unkin.net hostname).
- Placed in the bind-internal namespace alongside the unkin-net BindZone: the
  operator resolves zoneRef/clusterRef/updateKeyRef within the record's own
  namespace, so it cannot live in the app namespace.
- "internal" in the name distinguishes it from the external DNS Authentik will
  manage its own records from later.

benvin merged commit 421df740ea into main 2026-07-15 20:53:40 +10:00

benvin deleted branch benvin/identity-dns-internal 2026-07-15 20:53:40 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#256