From c1e2f7390c8946824598c21ac1f391906e6927ed Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 25 Jul 2026 22:33:06 +1000
Subject: [PATCH] Reflect externaldns TSIG key into the externaldns namespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The external-dns → in-cluster bind migration needs external-dns to present
the exact TSIG key that the in-cluster bind-externaldns primary accepts on
allow-update. The operator generates that key into Secret externaldns-key-tsig
in bind-internal; reflecting it removes the manual eyaml→Vault key sync.

- Add spec.secretTemplate.annotations to BindTSIGKey externaldns-key with the
  emberstack reflector hints (reflection-allowed, allowed/auto-namespaces
  externaldns, auto-enabled) so the operator stamps them onto the managed Secret.
- Regenerate schemas/bind.unkin.net/bindtsigkey_v1alpha1.json from the live CRD
  (deployed bind-operator v0.2.4 already exposes secretTemplate) to add the
  secretTemplate property.
---
 .../base/bind-internal/externaldns/tsigkey.yaml | 12 +++++++++++-
 .../bind.unkin.net/bindtsigkey_v1alpha1.json    | 17 +++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/apps/base/bind-internal/externaldns/tsigkey.yaml b/apps/base/bind-internal/externaldns/tsigkey.yaml
index 33ec5ce..1913a9d 100644
--- a/apps/base/bind-internal/externaldns/tsigkey.yaml
+++ b/apps/base/bind-internal/externaldns/tsigkey.yaml
@@ -1,6 +1,10 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
+# updates to the primary. The operator generates the material into a Secret
+# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
+# reflector hints onto that Secret so it is mirrored into the externaldns
+# namespace, where the external-dns controller reads it -- guaranteeing
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -9,3 +13,9 @@ metadata:
 spec:
   clusterRef: bind-externaldns
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"
diff --git a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
index 2b3ae33..affd4fd 100644
--- a/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
+++ b/schemas/bind.unkin.net/bindtsigkey_v1alpha1.json
@@ -35,6 +35,23 @@
         },
         "secretName": {
           "type": "string"
+        },
+        "secretTemplate": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"
-- 
2.47.3