unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

Publish real delegation records for acme.unkin.net #486

Merged
benvin merged 1 commits from benvin/acme-zone-delegation into main 2026-09-26 16:42:03 +10:00
Conversation 0 Commits 1 Files Changed 2
+37
unkin-agent commented 2026-09-26 15:11:07 +10:00
Member
Copy Link
Copy Source

The acme.unkin.net zone still serves only the bind-operator seed apex: NS ns1.acme.unkin.net glued to A 10.42.6.38, a pod IP no pod holds. The parent delegates to acme-ns1.unkin.net, but public resolvers have already promoted the child NS RRset, so when the cached address expires DNS-01 fails for every unkin.net wildcard at once.

  • Add apex NS acme-ns1.unkin.net., matching the parent delegation (out of zone, no glue needed).
  • Point ns1.acme.unkin.net at 103.216.191.185 so resolvers holding the seeded NS name still reach the zone.
  • The operator seed placeholder itself is tracked separately in bind-operator.
The acme.unkin.net zone still serves only the bind-operator seed apex: NS ns1.acme.unkin.net glued to A 10.42.6.38, a pod IP no pod holds. The parent delegates to acme-ns1.unkin.net, but public resolvers have already promoted the child NS RRset, so when the cached address expires DNS-01 fails for every unkin.net wildcard at once. - Add apex NS acme-ns1.unkin.net., matching the parent delegation (out of zone, no glue needed). - Point ns1.acme.unkin.net at 103.216.191.185 so resolvers holding the seeded NS name still reach the zone. - The operator seed placeholder itself is tracked separately in bind-operator.
unkin-agent added 1 commit 2026-09-26 15:11:08 +10:00
Publish real delegation records for acme.unkin.net
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
7e4d52bde4
benvin merged commit 812a9a2f2b into main 2026-09-26 16:42:03 +10:00
benvin deleted branch benvin/acme-zone-delegation 2026-09-26 16:42:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#486
Delete Branch "benvin/acme-zone-delegation"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?