2026-07-19 00:10:57 +10:00
1 changed files with 4 additions and 2 deletions
@@ -13,9 +13,11 @@ spec:
  storageSize: 2Gi
  # Restrict queries to internal networks (puppet acl-main.unkin.net).
  # 10.42.0.0/16 (pod net) is required so secondaries can SOA-refresh
-  # from the primary during catalog replication.
+  # from the primary during catalog replication. localhost is required so the
+  # operator's in-pod `nsupdate` (sent to 127.0.0.1) passes query-authorization;
+  # without it every dynamic update is "denied due to allow-query".
  extraOptions:
-    - "allow-query { auth-acl-main; 10.42.0.0/16; }"
+    - "allow-query { localhost; auth-acl-main; 10.42.0.0/16; }"
  service:
    type: LoadBalancer
    externalTrafficPolicy: Local