# Authoritative delegation records for acme.unkin.net. Without these the zone
# only holds the operator's seed apex (NS ns1.acme.unkin.net glued to the
# primary pod IP), which is unroutable off-cluster and goes stale on
# reschedule. DNSRecords must live in the same namespace as their BindZone.
---
apiVersion: bind.unkin.net/v1alpha1
kind: DNSRecord
metadata:
  name: acme-apex-ns
  namespace: bind-external
spec:
  zoneRef: acme-unkin-net
  # "@" is the zone apex.
  name: "@"
  type: NS
  ttl: 3600
  values:
    # Matches the parent delegation in Google Cloud DNS. Out of zone, so the
    # child needs no glue of its own.
    - acme-ns1.unkin.net.
---
apiVersion: bind.unkin.net/v1alpha1
kind: DNSRecord
metadata:
  name: acme-ns1-a
  namespace: bind-external
spec:
  zoneRef: acme-unkin-net
  name: ns1
  type: A
  ttl: 3600
  values:
    # Public address of this cluster's external BIND, same target as
    # acme-ns1.unkin.net. Resolvers that cached the seeded ns1.acme.unkin.net
    # NS name must still reach the zone.
    - 103.216.191.185