---
# Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
# updates to the primary. The operator generates the material into a Secret
# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
# reflector hints onto that Secret so it is mirrored into the externaldns
# namespace, where the external-dns controller reads it -- guaranteeing
# external-dns presents exactly the key the primary's allow-update accepts.
apiVersion: bind.unkin.net/v1alpha1
kind: BindTSIGKey
metadata:
  name: externaldns-key
  namespace: bind-internal
spec:
  clusterRef: bind-externaldns
  algorithm: hmac-sha256
  secretTemplate:
    annotations:
      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"