Repoint external-dns at the in-cluster bind-externaldns primary #287

Merged

benvin merged 1 commits from benvin/externaldns-incluster into main 2026-07-25 22:41:21 +10:00

Conversation 0 Commits 1 Files Changed 1

+6 -4

unkinben commented 2026-07-25 22:34:32 +10:00

Owner

Copy Link

Copy Source

Why

Step 2 of 3 in the external-dns → in-cluster bind migration. external-dns currently pushes RFC2136 updates to the legacy VM ausyd1nxvm2127.main.unkin.net. This repoints it at the in-cluster bind-externaldns primary so the in-cluster zone becomes the live source of truth for k8s.syd1.au.unkin.net + 200.18.198.in-addr.arpa.

Changes

• Points --rfc2136-host at bind-externaldns-primary.bind-internal.svc.cluster.local (verified live: ClusterIP Service bind-externaldns-primary exists in bind-internal).
• Reads TSIG secret + algorithm from Secret externaldns-key-tsig (reflected by PR 1) instead of the Vault-backed externaldns-tsig.
• Keeps port, zones, keyname, and txtOwnerId: k8s unchanged.
• Leaves the old Vault manifests (apps/base/externaldns/{vaultauth,vaultstaticsecret}.yaml) in place as the rollback path; their removal is a later cleanup PR.

Merge gate

• PR 1 (benvin/externaldns-tsig-reflect) merged, AND
• kubectl -n externaldns get secret externaldns-key-tsig returns keys secret + algorithm.

TXT-registry note

policy: sync + registry: txt: on first reconcile against the (currently empty) in-cluster zone, external-dns re-creates all managed A/CNAME records and their ownership TXTs from scratch. This is expected and populates the zone.

Verification (after merge)

kubectl -n externaldns logs deploy/externaldns --tail=100 | grep -Ei 'rfc2136|BADKEY|NOTAUTH|added|update'
dig +short @198.18.200.8 A puppet.k8s.syd1.au.unkin.net

Logs should show updates to bind-externaldns-primary... with NO BADKEY/NOTAUTH; sampled A records should start resolving against the in-cluster server (198.18.200.8) as the sync populates the zone.

Rollback

Revert this PR (host + secret name back to ausyd1nxvm2127.main.unkin.net / externaldns-tsig). The legacy VM is untouched and still authoritative.

## Why Step 2 of 3 in the external-dns → in-cluster bind migration. external-dns currently pushes RFC2136 updates to the legacy VM `ausyd1nxvm2127.main.unkin.net`. This repoints it at the in-cluster `bind-externaldns` primary so the in-cluster zone becomes the live source of truth for `k8s.syd1.au.unkin.net` + `200.18.198.in-addr.arpa`. ## Changes - Points `--rfc2136-host` at `bind-externaldns-primary.bind-internal.svc.cluster.local` (verified live: ClusterIP Service `bind-externaldns-primary` exists in `bind-internal`). - Reads TSIG `secret` + `algorithm` from Secret `externaldns-key-tsig` (reflected by PR 1) instead of the Vault-backed `externaldns-tsig`. - Keeps port, zones, keyname, and `txtOwnerId: k8s` unchanged. - Leaves the old Vault manifests (`apps/base/externaldns/{vaultauth,vaultstaticsecret}.yaml`) in place as the rollback path; their removal is a later cleanup PR. ## Merge gate - PR 1 (`benvin/externaldns-tsig-reflect`) merged, AND - `kubectl -n externaldns get secret externaldns-key-tsig` returns keys `secret` + `algorithm`. ## TXT-registry note `policy: sync` + `registry: txt`: on first reconcile against the (currently empty) in-cluster zone, external-dns re-creates all managed A/CNAME records and their ownership TXTs from scratch. This is expected and populates the zone. ## Verification (after merge) ``` kubectl -n externaldns logs deploy/externaldns --tail=100 | grep -Ei 'rfc2136|BADKEY|NOTAUTH|added|update' dig +short @198.18.200.8 A puppet.k8s.syd1.au.unkin.net ``` Logs should show updates to `bind-externaldns-primary...` with NO `BADKEY`/`NOTAUTH`; sampled A records should start resolving against the in-cluster server (198.18.200.8) as the sync populates the zone. ## Rollback Revert this PR (host + secret name back to `ausyd1nxvm2127.main.unkin.net` / `externaldns-tsig`). The legacy VM is untouched and still authoritative.

unkinben added 1 commit 2026-07-25 22:34:33 +10:00

Repoint external-dns at the in-cluster bind-externaldns primary ... c353fa797b

Step 2 of the external-dns → in-cluster bind migration. external-dns stops
sending RFC2136 updates to the legacy VM (ausyd1nxvm2127.main.unkin.net) and
targets the in-cluster bind-externaldns primary Service, reading the reflected
operator-generated TSIG key.

- Point --rfc2136-host at bind-externaldns-primary.bind-internal.svc.cluster.local
  (ClusterIP Service, verified live).
- Read the TSIG secret + algorithm from externaldns-key-tsig (reflected by PR 1)
  instead of the Vault-backed externaldns-tsig Secret.
- Keep port, zones, keyname, txtOwnerId, and the old Vault manifests unchanged;
  the Vault secret stays as a rollback path and is removed in a later cleanup PR.

benvin merged commit 8dc65779a5 into main 2026-07-25 22:41:21 +10:00

benvin deleted branch benvin/externaldns-incluster 2026-07-25 22:41:21 +10:00

unkinben referenced this issue from a commit 2026-07-28 22:10:55 +10:00

Revert external-dns writes back to the legacy VM authoritative (#287)

unkinben referenced this pull request 2026-07-28 22:11:10 +10:00

Revert external-dns writes back to the legacy VM authoritative (#287) #302

unkinben referenced this pull request 2026-08-02 16:24:31 +10:00

Finish the DNS migration off the Puppet zone to in-cluster bind #324

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#287