unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Add primary (write) Services to authoritative + externaldns #229

Merged
benvin merged 3 commits from benvin/wire-primary-service into main 2026-07-05 16:37:49 +10:00
Conversation 0 Commits 3 Files Changed 4
+47

3 Commits

Author SHA1 Message Date
benvin a52b5ad629 Merge branch 'main' into benvin/wire-primary-service
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
2026-07-05 16:09:23 +10:00
unkinben 4cdf9cef37 Add primary (write) Services to the authoritative + externaldns clusters
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
Writes (RFC2136/nsupdate) must hit pod-0; the round-robin read Service
would land them on a secondary. Add a dedicated write endpoint per
cluster (operator v0.1.5 primaryService field).

- bind-authoritative: LoadBalancer write endpoint on 198.18.200.9
- bind-externaldns: ClusterIP write endpoint (in-cluster writers)
- regenerate bindcluster kubeconform schema (primaryService +
  externalTrafficPolicy)

external-dns is NOT yet repointed at bind-externaldns-primary: it
authenticates with the existing key, which the operator-generated key
doesn't match until the planned Vault-sync / secret-reflection features
land.
 2026-07-04 23:16:20 +10:00
unkinben 4d1041925c Use externalTrafficPolicy: Local on the DNS services
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline failed
Details 
Preserves client source IPs so the authoritative/resolver source-IP ACLs
actually apply to external clients (Cluster SNATs them to node IPs).

- externalTrafficPolicy: Local on bind-authoritative/resolvers/externaldns
- bump operator to v0.1.5 (CRD link + image) for the new service field
 2026-07-04 22:16:55 +10:00