unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

Drop the redundant acme.unkin.net apex NS DNSRecord #502

Open
unkin-agent wants to merge 1 commits from benvin/drop-acme-apex-ns into main
pull from: benvin/drop-acme-apex-ns
merge into: unkin:main
Conversation 1 Commits 1 Files Changed 3
+5 -27
unkin-agent commented 2026-09-27 17:41:47 +10:00
Member
Copy Link
Copy Source

The apex NS RRset for acme.unkin.net is published by BindZone.spec.nameservers, which already lists both acme-ns1.unkin.net. and ns1.acme.unkin.net. — a superset of this DNSRecord. bind-operator now rejects an apex NS DNSRecord outright: BIND ignores an RRset-wide delete at a zone apex, so the record could only ever append to the live RRset.

  • Delete the acme-apex-ns DNSRecord and the now-empty ns/ kustomization.
  • Keep the ns1 A record, still needed so resolvers holding the seeded ns1.acme.unkin.net. name reach the zone.
  • Fold the surviving delegation notes into the zone kustomization header.
The apex NS RRset for acme.unkin.net is published by `BindZone.spec.nameservers`, which already lists both `acme-ns1.unkin.net.` and `ns1.acme.unkin.net.` — a superset of this DNSRecord. bind-operator now rejects an apex `NS` DNSRecord outright: BIND ignores an RRset-wide delete at a zone apex, so the record could only ever append to the live RRset. - Delete the `acme-apex-ns` DNSRecord and the now-empty `ns/` kustomization. - Keep the `ns1` A record, still needed so resolvers holding the seeded `ns1.acme.unkin.net.` name reach the zone. - Fold the surviving delegation notes into the zone kustomization header.
unkin-agent added 1 commit 2026-09-27 17:41:49 +10:00
Drop the redundant acme.unkin.net apex NS DNSRecord
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
6854042fe4
unkin-agent commented 2026-09-27 17:55:41 +10:00
Author
Member
Copy Link
Copy Source

apps/base/bind-external/acme-unkin-net/kustomization.yaml:2-3 — nit: the rewritten header claims the a/ records are what stops a reseed gluing ns1.acme.unkin.net to the pod IP, but zones.yaml:26-30 already declares the same ns1 A 103.216.191.185 in BindZone.spec.records, and that one converges (non-apex, so the RRset replace lands) → reword to say a/ns1.yaml duplicates spec.records, or drop a/ for the same reason ns/ went.

apps/base/bind-external/acme-unkin-net/kustomization.yaml:2-3 — nit: the rewritten header claims the `a/` records are what stops a reseed gluing `ns1.acme.unkin.net` to the pod IP, but `zones.yaml:26-30` already declares the same `ns1 A 103.216.191.185` in `BindZone.spec.records`, and that one converges (non-apex, so the RRset replace lands) → reword to say `a/ns1.yaml` duplicates `spec.records`, or drop `a/` for the same reason `ns/` went.
All checks were successful
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Required
Details
Checking for merge conflicts…
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin benvin/drop-acme-apex-ns:benvin/drop-acme-apex-ns
git checkout benvin/drop-acme-apex-ns
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#502
Delete Branch "benvin/drop-acme-apex-ns"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?