unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Reflect externaldns TSIG key into the externaldns namespace #285

Merged
benvin merged 1 commits from benvin/externaldns-tsig-reflect into main 2026-07-25 22:37:39 +10:00
Conversation 0 Commits 1 Files Changed 2
+28 -1
unkinben commented 2026-07-25 22:33:28 +10:00
Owner
Copy Link
Copy Source

Why

Step 1 of 3 in the external-dns → in-cluster bind migration. For external-dns to send RFC2136 updates to the in-cluster bind-externaldns primary, it must present the exact TSIG key the primary's allow-update accepts. The bind-operator generates that key material into Secret externaldns-key-tsig in bind-internal; reflecting it into the externaldns namespace removes the manual eyaml→Vault key sync and guarantees key parity.

Changes

  • Adds spec.secretTemplate.annotations to BindTSIGKey externaldns-key with the emberstack reflector hints: reflection-allowed, reflection-allowed-namespaces: externaldns, reflection-auto-enabled, reflection-auto-namespaces: externaldns.
  • Regenerates schemas/bind.unkin.net/bindtsigkey_v1alpha1.json from the live CRD (deployed bind-operator v0.2.4 already exposes secretTemplate — the WIP branch's ">= v0.3.0" claim is stale) to add the secretTemplate property. Schema output is byte-identical to running ci/generate-schemas.sh.

kubectl kustomize apps/overlays/au-syd1/bind-internal builds clean and renders the annotations onto the BindTSIGKey.

Verification (after merge)

kubectl -n externaldns get secret externaldns-key-tsig \
  -o jsonpath='{.data.secret} {.data.algorithm}{"\n"}'

Both secret and algorithm keys must be present (reflector mirrored the source Secret from bind-internal).

Rollback

Revert this PR. The source Secret in bind-internal is unaffected; only the reflected mirror in externaldns is removed.

Merge order: this is PR 1/3. PR 2 (repoint external-dns) must not merge until the reflected secret is verified.

## Why Step 1 of 3 in the external-dns → in-cluster bind migration. For external-dns to send RFC2136 updates to the in-cluster `bind-externaldns` primary, it must present the exact TSIG key the primary's `allow-update` accepts. The bind-operator generates that key material into Secret `externaldns-key-tsig` in `bind-internal`; reflecting it into the `externaldns` namespace removes the manual eyaml→Vault key sync and guarantees key parity. ## Changes - Adds `spec.secretTemplate.annotations` to BindTSIGKey `externaldns-key` with the emberstack reflector hints: `reflection-allowed`, `reflection-allowed-namespaces: externaldns`, `reflection-auto-enabled`, `reflection-auto-namespaces: externaldns`. - Regenerates `schemas/bind.unkin.net/bindtsigkey_v1alpha1.json` from the live CRD (deployed bind-operator v0.2.4 already exposes `secretTemplate` — the WIP branch's ">= v0.3.0" claim is stale) to add the `secretTemplate` property. Schema output is byte-identical to running `ci/generate-schemas.sh`. `kubectl kustomize apps/overlays/au-syd1/bind-internal` builds clean and renders the annotations onto the BindTSIGKey. ## Verification (after merge) ``` kubectl -n externaldns get secret externaldns-key-tsig \ -o jsonpath='{.data.secret} {.data.algorithm}{"\n"}' ``` Both `secret` and `algorithm` keys must be present (reflector mirrored the source Secret from bind-internal). ## Rollback Revert this PR. The source Secret in bind-internal is unaffected; only the reflected mirror in `externaldns` is removed. Merge order: this is PR 1/3. PR 2 (repoint external-dns) must not merge until the reflected secret is verified.
unkinben added 1 commit 2026-07-25 22:33:28 +10:00
Reflect externaldns TSIG key into the externaldns namespace
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
c1e2f7390c 
The external-dns → in-cluster bind migration needs external-dns to present
the exact TSIG key that the in-cluster bind-externaldns primary accepts on
allow-update. The operator generates that key into Secret externaldns-key-tsig
in bind-internal; reflecting it removes the manual eyaml→Vault key sync.

- Add spec.secretTemplate.annotations to BindTSIGKey externaldns-key with the
  emberstack reflector hints (reflection-allowed, allowed/auto-namespaces
  externaldns, auto-enabled) so the operator stamps them onto the managed Secret.
- Regenerate schemas/bind.unkin.net/bindtsigkey_v1alpha1.json from the live CRD
  (deployed bind-operator v0.2.4 already exposes secretTemplate) to add the
  secretTemplate property.
benvin merged commit 8eeca2d1fb into main 2026-07-25 22:37:39 +10:00
benvin deleted branch benvin/externaldns-tsig-reflect 2026-07-25 22:37:39 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#285
Delete Branch "benvin/externaldns-tsig-reflect"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?