Step 2 of the external-dns → in-cluster bind migration. external-dns stops
sending RFC2136 updates to the legacy VM (ausyd1nxvm2127.main.unkin.net) and
targets the in-cluster bind-externaldns primary Service, reading the reflected
operator-generated TSIG key.
- Point --rfc2136-host at bind-externaldns-primary.bind-internal.svc.cluster.local
(ClusterIP Service, verified live).
- Read the TSIG secret + algorithm from externaldns-key-tsig (reflected by PR 1)
instead of the Vault-backed externaldns-tsig Secret.
- Keep port, zones, keyname, txtOwnerId, and the old Vault manifests unchanged;
the Vault secret stays as a rollback path and is removed in a later cleanup PR.
unkinben