---
# Self-delegated ACME challenge zone. Google Cloud DNS holds a one-time
# _acme-challenge.unkin.net CNAME -> _acme-challenge.acme.unkin.net and an
# acme.unkin.net NS delegation pointing here; cert-manager writes the challenge
# TXT records via RFC2136 authenticated with the certmanager key.
apiVersion: bind.unkin.net/v1alpha1
kind: BindZone
metadata:
  name: acme-unkin-net
  namespace: bind-external
spec:
  clusterRef: bind-external
  zoneName: acme.unkin.net
  type: primary
  defaultTTL: 60
  dynamicUpdate: true
  updateKeyRef: certmanager
  allowTransfer:
    - key certmanager