# Individually-managed authoritative records for the unkin.net zone.
# DNSRecords must live in the same namespace as their BindZone (the operator
# resolves zoneRef/clusterRef/updateKeyRef within the record's namespace), so
# these sit alongside the zone in bind-internal, not in the app namespace.
---
apiVersion: bind.unkin.net/v1alpha1
kind: DNSRecord
metadata:
  # "internal" in the name distinguishes this from the external DNS that
  # Authentik will manage its own records from later.
  name: identity-dns-internal
  namespace: bind-internal
spec:
  zoneRef: unkin-net
  name: identity
  type: A
  ttl: 600
  values:
    # traefik-internal gateway VIP; the authentik Gateway serves the
    # identity.unkin.net hostname there.
    - 198.18.200.4