Flip resolver forwarding for k8s zones to the in-cluster bind #288

2026-07-25T22:35:38+10:00

unkinben commented

2026-07-25 22:35:38 +10:00

Why

Step 3 of 3 in the external-dns → in-cluster bind migration: the client-visible cutover. The openforwarder resolvers currently forward k8s.syd1.au.unkin.net to the legacy VM anycast 198.18.19.20 (a temporary measure — commit 7ee5dfb) and have NO forwarder at all for the reverse zone 200.18.198.in-addr.arpa. Once external-dns publishes to the in-cluster bind-externaldns (PR 2), resolvers must read from it.

Changes

Repoints the fwd-k8s-syd1-au-unkin-net forwarder from 198.18.19.20 (legacy VM) to 198.18.200.8 (in-cluster bind-externaldns VIP).
Adds fwd-200-18-198-in-addr-arpa forwarding 200.18.198.in-addr.arpa → 198.18.200.8, closing the reverse-zone gap so PTR lookups for the k8s LB range keep resolving after cutover. Modeled exactly on the existing forward-zone entries.
Refreshes the header comment to describe the in-cluster upstream.

kubectl kustomize apps/overlays/au-syd1/bind-internal builds clean; both zones render with forwarder 198.18.200.8 and there is no residual 198.18.19.20.

Merge gate

PR 2 (benvin/externaldns-incluster) merged, AND

record parity confirmed between legacy and in-cluster for the forward zone. Spot-check (repeat for each name):

for n in puppetca puppet puppetdb encapi pdbmux artifactapi consul; do
  echo "$n:"
  dig +short @198.18.19.20 A $n.k8s.syd1.au.unkin.net
  dig +short @198.18.200.8  A $n.k8s.syd1.au.unkin.net
done
# plus 2-3 PTRs in the reverse zone:
dig +short @198.18.19.20 -x 198.18.200.8
dig +short @198.18.200.8  -x 198.18.200.8

A/PTR answers from 198.18.200.8 must match those from 198.18.19.20 before merging.

Verification (after merge)

dig +short @198.18.200.7 A puppet.k8s.syd1.au.unkin.net   # resolvers VIP
dig +short @198.18.200.7 -x 198.18.200.8                  # reverse via resolvers

Resolution through the bind-resolvers VIP should now answer for both the forward and reverse k8s zones.

Rollback

Revert this PR — the fwd-k8s-syd1-au-unkin-net forwarder returns to 198.18.19.20 and the reverse forward is removed. The legacy VM is untouched and remains authoritative until decommission.

## Why Step 3 of 3 in the external-dns → in-cluster bind migration: the client-visible cutover. The `openforwarder` resolvers currently forward `k8s.syd1.au.unkin.net` to the legacy VM anycast `198.18.19.20` (a temporary measure — commit 7ee5dfb) and have NO forwarder at all for the reverse zone `200.18.198.in-addr.arpa`. Once external-dns publishes to the in-cluster `bind-externaldns` (PR 2), resolvers must read from it. ## Changes - Repoints the `fwd-k8s-syd1-au-unkin-net` forwarder from `198.18.19.20` (legacy VM) to `198.18.200.8` (in-cluster `bind-externaldns` VIP). - Adds `fwd-200-18-198-in-addr-arpa` forwarding `200.18.198.in-addr.arpa` → `198.18.200.8`, closing the reverse-zone gap so PTR lookups for the k8s LB range keep resolving after cutover. Modeled exactly on the existing forward-zone entries. - Refreshes the header comment to describe the in-cluster upstream. `kubectl kustomize apps/overlays/au-syd1/bind-internal` builds clean; both zones render with forwarder `198.18.200.8` and there is no residual `198.18.19.20`. ## Merge gate - PR 2 (`benvin/externaldns-incluster`) merged, AND - record parity confirmed between legacy and in-cluster for the forward zone. Spot-check (repeat for each name): ``` for n in puppetca puppet puppetdb encapi pdbmux artifactapi consul; do echo "$n:" dig +short @198.18.19.20 A $n.k8s.syd1.au.unkin.net dig +short @198.18.200.8 A $n.k8s.syd1.au.unkin.net done # plus 2-3 PTRs in the reverse zone: dig +short @198.18.19.20 -x 198.18.200.8 dig +short @198.18.200.8 -x 198.18.200.8 ``` A/PTR answers from `198.18.200.8` must match those from `198.18.19.20` before merging. ## Verification (after merge) ``` dig +short @198.18.200.7 A puppet.k8s.syd1.au.unkin.net # resolvers VIP dig +short @198.18.200.7 -x 198.18.200.8 # reverse via resolvers ``` Resolution through the `bind-resolvers` VIP should now answer for both the forward and reverse k8s zones. ## Rollback Revert this PR — the `fwd-k8s-syd1-au-unkin-net` forwarder returns to `198.18.19.20` and the reverse forward is removed. The legacy VM is untouched and remains authoritative until decommission.

unkinben added 1 commit 2026-07-25 22:35:39 +10:00

Flip resolver forwarding for k8s zones to the in-cluster bind

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

bdbbba3e70

Step 3 of the external-dns → in-cluster bind migration: the client-visible
cutover. The openforwarder resolvers stop reading the legacy VM and forward
the k8s zones to the in-cluster bind-externaldns VIP (198.18.200.8), which
external-dns now populates.

- Repoint the fwd-k8s-syd1-au-unkin-net forwarder from the legacy VM anycast
  198.18.19.20 to the in-cluster bind-externaldns VIP 198.18.200.8.
- Add fwd-200-18-198-in-addr-arpa forwarding 200.18.198.in-addr.arpa to
  198.18.200.8, closing the reverse-zone gap so PTR lookups for the k8s LB
  range resolve after cutover.
- Refresh the header comment to describe the in-cluster upstream.

benvin merged commit 7a889ca326 into main

2026-07-25 23:08:22 +10:00

benvin deleted branch benvin/externaldns-resolver-flip

2026-07-25 23:08:22 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/argocd-apps#288