unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Reflect externaldns TSIG key into the externaldns namespace #285

Merged
benvin merged 1 commits from benvin/externaldns-tsig-reflect into main 2026-07-25 22:37:39 +10:00
Conversation 0 Commits 1 Files Changed 2
+28 -1

1 Commits

Author SHA1 Message Date
unkinben c1e2f7390c Reflect externaldns TSIG key into the externaldns namespace
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
The external-dns → in-cluster bind migration needs external-dns to present
the exact TSIG key that the in-cluster bind-externaldns primary accepts on
allow-update. The operator generates that key into Secret externaldns-key-tsig
in bind-internal; reflecting it removes the manual eyaml→Vault key sync.

- Add spec.secretTemplate.annotations to BindTSIGKey externaldns-key with the
  emberstack reflector hints (reflection-allowed, allowed/auto-namespaces
  externaldns, auto-enabled) so the operator stamps them onto the managed Secret.
- Regenerate schemas/bind.unkin.net/bindtsigkey_v1alpha1.json from the live CRD
  (deployed bind-operator v0.2.4 already exposes secretTemplate) to add the
  secretTemplate property.
 2026-07-25 22:33:06 +10:00