unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

bind-internal: add ceph.unkin.net authoritative zone #260

Merged
benvin merged 1 commits from benvin/bind-add-ceph-zone into main 2026-07-17 22:43:28 +10:00
Conversation 2 Commits 1 Files Changed 1
+16
unkinben commented 2026-07-16 23:51:29 +10:00
Owner
Copy Link
Copy Source

Why

The ceph/halb host (ausyd1nxvm2069) publishes dashboard.ceph.unkin.net via nsupdate to a dedicated zone ceph.unkin.net., which bind-authoritative was not authoritative for (NOTZONE). This adds the zone so that record has a home.

Changes

  • Add ceph.unkin.net BindZone (primary, dynamicUpdate, updateKeyRef client-update) to bind-authoritative, matching the unkin.net/main.unkin.net pattern.

Note — not the root cause of the 6 missing hosts

Log evidence (VictoriaLogs, dns-update-apply on 2069/2070) shows the actual failure is a host-side bug in the puppet dns-update script: fqdn() appends the zone even to records whose name is already fully-qualified (e.g. au-syd1-pve.main.unkin.net., cobbler.main.unkin.net.), producing a .. empty label → invalid owner name: empty label → the whole main.unkin.net update send fails (reverse PTR, sent first, still lands). That script fix (puppet-prod) is the real blocker; this zone is still needed so the ceph record does not hit NOTZONE afterward.

## Why The ceph/halb host (`ausyd1nxvm2069`) publishes `dashboard.ceph.unkin.net` via nsupdate to a dedicated `zone ceph.unkin.net.`, which `bind-authoritative` was not authoritative for (NOTZONE). This adds the zone so that record has a home. ## Changes - Add `ceph.unkin.net` BindZone (primary, dynamicUpdate, updateKeyRef client-update) to bind-authoritative, matching the unkin.net/main.unkin.net pattern. ## Note — not the root cause of the 6 missing hosts Log evidence (VictoriaLogs, dns-update-apply on 2069/2070) shows the actual failure is a **host-side bug in the puppet `dns-update` script**: `fqdn()` appends the zone even to records whose name is already fully-qualified (e.g. `au-syd1-pve.main.unkin.net.`, `cobbler.main.unkin.net.`), producing a `..` empty label → `invalid owner name: empty label` → the whole main.unkin.net update `send` fails (reverse PTR, sent first, still lands). That script fix (puppet-prod) is the real blocker; this zone is still needed so the ceph record does not hit NOTZONE afterward.
unkinben added 1 commit 2026-07-16 23:51:29 +10:00
bind-internal: add ceph.unkin.net authoritative zone
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
2faf3dc4bb 
The ceph/halb host (ausyd1nxvm2069) publishes dashboard.ceph.unkin.net via
nsupdate to a dedicated 'zone ceph.unkin.net.', which bind-authoritative did
not serve (NOTZONE). Adds it as a primary dynamicUpdate zone alongside
unkin.net/main.unkin.net so the record has a home once the host-side
dns-update script is fixed.
benvin commented 2026-07-17 07:33:13 +10:00
Owner
Copy Link
Copy Source

Should this also update the resolvers to forward requests for this domain to the authoritative bind service?

Should this also update the resolvers to forward requests for this domain to the authoritative bind service?
unkinben commented 2026-07-17 07:38:49 +10:00
Author
Owner
Copy Link
Copy Source

No resolver change is needed — the existing fwd-unkin-net forward zone (unkin.net → 198.18.200.6) already covers ceph.unkin.net.

In BIND a forward zone matches the named domain and all subdomains, unless a more-specific forward exists (none does here). And ceph.unkin.net is served by the same authoritative server (198.18.200.6) as unkin.net, so the query already lands in the right place.

Verified live: dig @198.18.200.7 dashboard.ceph.unkin.net currently returns NXDOMAIN with the authority SOA ns1.unkin.net. — i.e. the resolver is already forwarding it to .6, and .6 answers from its unkin.net zone. Once this PR merges and .6 serves ceph.unkin.net as its own zone, the same forward path resolves it authoritatively. No fwd-ceph-unkin-net entry required.

(A separate resolver forward would only be needed if ceph.unkin.net were served by a different server than unkin.net, the way k8s.syd1.au.unkin.net → .8 is.)

No resolver change is needed — the existing `fwd-unkin-net` forward zone (`unkin.net` → 198.18.200.6) already covers `ceph.unkin.net`. In BIND a `forward` zone matches the named domain **and all subdomains**, unless a more-specific forward exists (none does here). And `ceph.unkin.net` is served by the same authoritative server (198.18.200.6) as `unkin.net`, so the query already lands in the right place. Verified live: `dig @198.18.200.7 dashboard.ceph.unkin.net` currently returns NXDOMAIN with the authority SOA `ns1.unkin.net.` — i.e. the resolver is already forwarding it to .6, and .6 answers from its `unkin.net` zone. Once this PR merges and .6 serves `ceph.unkin.net` as its own zone, the same forward path resolves it authoritatively. No `fwd-ceph-unkin-net` entry required. (A separate resolver forward would only be needed if `ceph.unkin.net` were served by a *different* server than `unkin.net`, the way `k8s.syd1.au.unkin.net` → .8 is.)
benvin merged commit 706e30a202 into main 2026-07-17 22:43:28 +10:00
benvin deleted branch benvin/bind-add-ceph-zone 2026-07-17 22:43:28 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#260
Delete Branch "benvin/bind-add-ceph-zone"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?