unkinben
0ec308b76e
## Why New forward records (netbox, logs-ingest .k8s.syd1.au.unkin.net) stopped appearing in DNS after #287. Root cause is a half-completed migration, not an external-dns fault: - #287 (step 2/3) repointed external-dns RFC2136 updates from the legacy VM `ausyd1nxvm2127.main.unkin.net` to the in-cluster `bind-externaldns-primary`. - external-dns is writing correctly: the in-cluster bind (198.18.200.8 / bind-resolvers 198.18.200.7) HAS netbox + logs-ingest A records and their external-dns TXT ownership records (SOA serial 5). - But the estate's client-facing resolvers (e.g. 198.18.2.160) still source the zone from the legacy VM authoritative, which is alive but now FROZEN: it keeps old names (identity, argocd, grafana resolve fine) and never receives the new writes. Step 3 (cut resolver/delegation reads over to the in-cluster bind) was never done, so writes moved ahead of reads. Reverting restores external-dns writes to the legacy authoritative that clients actually read, immediately unblocking new-record publication. This is exactly the rollback path documented in #287 ("The legacy VM is untouched and still authoritative"). Re-attempt the cutover only after step 3 lands. ## Changes - `--rfc2136-host` back to `ausyd1nxvm2127.main.unkin.net`. - TSIG secret ref back to Vault-backed `externaldns-tsig` (still present in the namespace). ## Note The per-cycle PTR add/remove thrash on 198.18.200.4 and the "Couldn't parse ... as an IP address" debug lines are a separate, cosmetic external-dns rfc2136 multi-target-PTR quirk; they are NOT the cause of the missing A records and are unaffected by this change. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
66 lines
1.7 KiB
YAML
66 lines
1.7 KiB
YAML
# Service account configuration
|
|
serviceAccount:
|
|
create: true
|
|
name: externaldns
|
|
annotations: {}
|
|
|
|
# Provider configuration - using new format
|
|
provider:
|
|
name: rfc2136
|
|
|
|
# Domain filtering
|
|
domainFilters:
|
|
- "k8s.syd1.au.unkin.net"
|
|
- "200.18.198.in-addr.arpa"
|
|
|
|
# TXT registry configuration
|
|
txtOwnerId: "k8s"
|
|
registry: "txt"
|
|
|
|
# Enable deletion of records for dedicated DNS server
|
|
policy: "sync"
|
|
|
|
# Keep default sources
|
|
sources:
|
|
- service
|
|
- ingress
|
|
- gateway-httproute
|
|
- gateway-grpcroute
|
|
|
|
# Environment variables for TSIG secret and algorithm from Vault
|
|
env:
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: externaldns-tsig
|
|
key: secret
|
|
- name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: externaldns-tsig
|
|
key: algorithm
|
|
|
|
# RFC2136 configuration as arguments
|
|
extraArgs:
|
|
- --rfc2136-host=ausyd1nxvm2127.main.unkin.net
|
|
- --rfc2136-port=53
|
|
- --rfc2136-zone=k8s.syd1.au.unkin.net
|
|
- --rfc2136-zone=200.18.198.in-addr.arpa
|
|
# Synthesize PTR records into the reverse zone for every A record managed in
|
|
# the forward zone (the reverse zone + resolver forwarder exist since #288;
|
|
# without this flag nothing writes PTRs).
|
|
- --create-ptr
|
|
# --create-ptr requires PTR in the managed record types; setting the flag
|
|
# replaces the default list (A,AAAA,CNAME), so re-state the defaults too.
|
|
- --managed-record-types=A
|
|
- --managed-record-types=AAAA
|
|
- --managed-record-types=CNAME
|
|
- --managed-record-types=PTR
|
|
- --rfc2136-tsig-keyname=externaldns-key
|
|
- --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM)
|
|
- --rfc2136-tsig-axfr
|
|
- --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
|
|
- --ingress-class=nginx
|
|
|
|
logLevel: debug
|