From d5b1c88c49a2f434ff7f6ed97d11099fdce2113e Mon Sep 17 00:00:00 2001 From: benvin Date: Sun, 19 Jul 2026 00:02:20 +1000 Subject: [PATCH] bind-internal: allow localhost to query the authoritative cluster Every bind-operator dynamic update was refused ("denied due to allow-query") because the operator execs nsupdate against 127.0.0.1 inside the primary pod, and allow-query listed only the client subnets (auth-acl-main) and the pod net (10.42.0.0/16) -- not loopback. This blocked ALL DNSRecords (identity, s3, dashboard, lb1) from ever applying. - Add localhost to the BindCluster allow-query so in-pod nsupdate passes query-authorization; the TSIG key (client-update) still gates the update. --- apps/base/bind-internal/authoritative/cluster.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/base/bind-internal/authoritative/cluster.yaml b/apps/base/bind-internal/authoritative/cluster.yaml index 3096cbd..de2a627 100644 --- a/apps/base/bind-internal/authoritative/cluster.yaml +++ b/apps/base/bind-internal/authoritative/cluster.yaml @@ -13,9 +13,11 @@ spec: storageSize: 2Gi # Restrict queries to internal networks (puppet acl-main.unkin.net). # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh - # from the primary during catalog replication. + # from the primary during catalog replication. localhost is required so the + # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization; + # without it every dynamic update is "denied due to allow-query". extraOptions: - - "allow-query { auth-acl-main; 10.42.0.0/16; }" + - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }" service: type: LoadBalancer externalTrafficPolicy: Local -- 2.47.3