unkinben
4163bf80b3
identity.unkin.net was configured as the Authentik OIDC issuer but has no DNS record anywhere, so in-cluster OIDC discovery (e.g. argocd-server) fails to resolve it. Add an authoritative A record via the bind-operator so the internal bind system serves it. - New DNSRecord identity-dns-internal -> 198.18.200.4 (traefik-internal VIP, where the authentik Gateway serves the identity.unkin.net hostname). - Placed in the bind-internal namespace alongside the unkin-net BindZone: the operator resolves zoneRef/clusterRef/updateKeyRef within the record's own namespace, so it cannot live in the app namespace. - "internal" in the name distinguishes it from the external DNS Authentik will manage its own records from later.