From 4d1041925cffae1a90982f1e4a0ed01392dd1b97 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 4 Jul 2026 22:16:55 +1000 Subject: [PATCH 1/2] Use externalTrafficPolicy: Local on the DNS services Preserves client source IPs so the authoritative/resolver source-IP ACLs actually apply to external clients (Cluster SNATs them to node IPs). - externalTrafficPolicy: Local on bind-authoritative/resolvers/externaldns - bump operator to v0.1.5 (CRD link + image) for the new service field --- apps/base/bind-internal/authoritative/cluster.yaml | 1 + apps/base/bind-internal/externaldns/cluster.yaml | 1 + apps/base/bind-internal/resolvers/cluster.yaml | 1 + apps/base/bind-system/deployment.yaml | 2 +- apps/base/bind-system/kustomization.yaml | 2 +- 5 files changed, 5 insertions(+), 2 deletions(-) diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml index ea08a66..6afd4e2 100644 --- a/apps/base/bind-internal/authoritative/cluster.yaml +++ b/apps/base/bind-internal/authoritative/cluster.yaml @@ -18,6 +18,7 @@ spec: - "allow-query { auth-acl-main; 10.42.0.0/16; }" service: type: LoadBalancer + externalTrafficPolicy: Local annotations: purelb.io/service-group: common purelb.io/addresses: 198.18.200.6 diff --git a/apps/base/bind-internal/externaldns/cluster.yaml b/apps/base/bind-internal/externaldns/cluster.yaml index 14b0fb5..376082e 100644 --- a/apps/base/bind-internal/externaldns/cluster.yaml +++ b/apps/base/bind-internal/externaldns/cluster.yaml @@ -14,6 +14,7 @@ spec: storageSize: 1Gi service: type: LoadBalancer + externalTrafficPolicy: Local annotations: purelb.io/service-group: common purelb.io/addresses: 198.18.200.8 diff --git a/apps/base/bind-internal/resolvers/cluster.yaml b/apps/base/bind-internal/resolvers/cluster.yaml index f99b8b9..e6c8231 100644 --- a/apps/base/bind-internal/resolvers/cluster.yaml +++ b/apps/base/bind-internal/resolvers/cluster.yaml @@ -13,6 +13,7 @@ spec: storageSize: 1Gi service: type: LoadBalancer + externalTrafficPolicy: Local annotations: purelb.io/service-group: common purelb.io/addresses: 198.18.200.7 diff --git a/apps/base/bind-system/deployment.yaml b/apps/base/bind-system/deployment.yaml index c090504..69e77b6 100644 --- a/apps/base/bind-system/deployment.yaml +++ b/apps/base/bind-system/deployment.yaml @@ -21,7 +21,7 @@ spec: runAsNonRoot: true containers: - name: operator - image: git.unkin.net/unkin/bind-operator:v0.1.4 + image: git.unkin.net/unkin/bind-operator:v0.1.5 args: - --metrics-bind-address=:8080 - --health-probe-bind-address=:8081 diff --git a/apps/base/bind-system/kustomization.yaml b/apps/base/bind-system/kustomization.yaml index 6940615..9f036fe 100644 --- a/apps/base/bind-system/kustomization.yaml +++ b/apps/base/bind-system/kustomization.yaml @@ -6,6 +6,6 @@ resources: - namespace.yaml # CRDs are pulled from the bind-operator repo at the matching tag rather than # vendored here, so they never drift from the operator. - - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.3/config/crd/install.yaml + - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.1.5/config/crd/install.yaml - rbac.yaml - deployment.yaml -- 2.47.3 From 4cdf9cef37b1c07b7d83698921533573fb7cefd4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 4 Jul 2026 23:16:20 +1000 Subject: [PATCH 2/2] Add primary (write) Services to the authoritative + externaldns clusters Writes (RFC2136/nsupdate) must hit pod-0; the round-robin read Service would land them on a secondary. Add a dedicated write endpoint per cluster (operator v0.1.5 primaryService field). - bind-authoritative: LoadBalancer write endpoint on 198.18.200.9 - bind-externaldns: ClusterIP write endpoint (in-cluster writers) - regenerate bindcluster kubeconform schema (primaryService + externalTrafficPolicy) external-dns is NOT yet repointed at bind-externaldns-primary: it authenticates with the existing key, which the operator-generated key doesn't match until the planned Vault-sync / secret-reflection features land. --- .../bind-internal/authoritative/cluster.yaml | 6 ++++ .../bind-internal/externaldns/cluster.yaml | 2 ++ .../bind.unkin.net/bindcluster_v1alpha1.json | 36 +++++++++++++++++++ 3 files changed, 44 insertions(+) diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml index 6afd4e2..639d780 100644 --- a/apps/base/bind-internal/authoritative/cluster.yaml +++ b/apps/base/bind-internal/authoritative/cluster.yaml @@ -23,6 +23,12 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.6 external-dns.alpha.kubernetes.io/hostname: bind-authoritative.k8s.syd1.au.unkin.net + primaryService: + type: LoadBalancer + annotations: + purelb.io/service-group: common + purelb.io/addresses: 198.18.200.9 + external-dns.alpha.kubernetes.io/hostname: bind-authoritative-primary.k8s.syd1.au.unkin.net resources: requests: cpu: 100m diff --git a/apps/base/bind-internal/externaldns/cluster.yaml b/apps/base/bind-internal/externaldns/cluster.yaml index 376082e..5b2a0ca 100644 --- a/apps/base/bind-internal/externaldns/cluster.yaml +++ b/apps/base/bind-internal/externaldns/cluster.yaml @@ -19,6 +19,8 @@ spec: purelb.io/service-group: common purelb.io/addresses: 198.18.200.8 external-dns.alpha.kubernetes.io/hostname: bind-externaldns.k8s.syd1.au.unkin.net + primaryService: + type: ClusterIP resources: requests: cpu: 100m diff --git a/schemas/bind.unkin.net/bindcluster_v1alpha1.json b/schemas/bind.unkin.net/bindcluster_v1alpha1.json index 1aaa072..abecc82 100644 --- a/schemas/bind.unkin.net/bindcluster_v1alpha1.json +++ b/schemas/bind.unkin.net/bindcluster_v1alpha1.json @@ -692,6 +692,35 @@ }, "type": "object" }, + "primaryService": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "externalTrafficPolicy": { + "enum": [ + "Cluster", + "Local" + ], + "type": "string" + }, + "loadBalancerIP": { + "type": "string" + }, + "type": { + "enum": [ + "ClusterIP", + "LoadBalancer", + "NodePort" + ], + "type": "string" + } + }, + "type": "object" + }, "recursion": { "type": "boolean" }, @@ -765,6 +794,13 @@ }, "type": "object" }, + "externalTrafficPolicy": { + "enum": [ + "Cluster", + "Local" + ], + "type": "string" + }, "loadBalancerIP": { "type": "string" }, -- 2.47.3