apps/overlays/au-syd1/externaldns/values.yaml

@@ -27,22 +27,24 @@ sources:
   - gateway-httproute
   - gateway-grpcroute
 
-# Environment variables for TSIG secret and algorithm from Vault
+# TSIG secret + algorithm. The bind operator generates this key in
+# bind-internal (BindTSIGKey externaldns-key) and the emberstack reflector
+# mirrors the Secret into this namespace as externaldns-key-tsig.
 env:
   - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
     valueFrom:
       secretKeyRef:
-        name: externaldns-tsig
+        name: externaldns-key-tsig
         key: secret
   - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
     valueFrom:
       secretKeyRef:
-        name: externaldns-tsig
+        name: externaldns-key-tsig
         key: algorithm
 
 # RFC2136 configuration as arguments
 extraArgs:
-  - --rfc2136-host=ausyd1nxvm2127.main.unkin.net
+  - --rfc2136-host=bind-externaldns-primary.bind-internal.svc.cluster.local
   - --rfc2136-port=53
   - --rfc2136-zone=k8s.syd1.au.unkin.net
   - --rfc2136-zone=200.18.198.in-addr.arpa