apps/base/binddns-externaldns/cluster.yaml

@@ -1,13 +1,14 @@
 ---
-# external-dns tier (replaces the 3x Puppet external-dns servers). The primary
-# accepts RFC2136 TSIG updates from external-dns; secondaries replicate.
+# external-dns tier (replaces the 3x Puppet external-dns servers). An ordinary
+# authoritative cluster; external-dns writes to its zones via RFC2136 because
+# those BindZones set dynamicUpdate (allow-update { key externaldns-key; }).
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindCluster
 metadata:
   name: externaldns
   namespace: binddns-externaldns
 spec:
-  mode: dynamic
+  mode: authoritative
   replicas: 3
   storageClassName: cephrbd-fast-delete
   storageSize: 1Gi

schemas/bind.unkin.net/bindcluster_v1alpha1.json

@@ -682,8 +682,7 @@
           "default": "authoritative",
           "enum": [
             "authoritative",
-            "resolver",
-            "dynamic"
+            "resolver"
           ],
           "type": "string"
         },